urlquery - report: snnl-glo.ketogermany.com/t/clk

Fully Qualifying Domain Name	Rank	First Seen	Last Seen	IP	Comment
content-signature-2.cdn.mozilla.net (1)	1152	2020-11-03 12:26:46 UTC	2022-09-26 04:26:56 UTC	143.204.55.25
contile.services.mozilla.com (1)	1114	2021-05-27 18:32:35 UTC	2022-09-26 04:28:07 UTC	34.117.237.239
ocsp.digicert.com (1)	86	2012-05-21 07:02:23 UTC	2022-09-26 22:11:41 UTC	93.184.220.29
admoustache.go2affise.com (1)	84756	2017-05-04 20:13:42 UTC	2022-09-26 12:53:39 UTC	34.90.46.36
cola.labtrffc.com (1)	0	2021-09-13 19:54:14 UTC	2022-09-27 01:01:16 UTC	51.83.143.92	Domain (labtrffc.com) ranked at: 87846
r3.o.lencr.org (11)	344	2020-12-02 08:52:13 UTC	2022-09-26 04:35:11 UTC	23.36.77.32
ocsp.sca1b.amazontrust.com (1)	1015	2017-03-03 15:20:51 UTC	2019-03-27 04:05:54 UTC	143.204.42.158
img-getpocket.cdn.mozilla.net (6)	1631	2017-09-01 03:40:57 UTC	2022-09-26 12:15:18 UTC	34.120.237.76
t2.blowingwnd.com (1)	0	2022-08-03 13:42:13 UTC	2022-09-26 21:41:21 UTC	51.161.115.163	Unknown ranking
48.us.findthewind.xyz (1)	0	2022-08-03 12:55:54 UTC	2022-09-26 21:41:32 UTC	23.235.251.114	Unknown ranking
8.us.findthewnd.xyz (1)	0	2022-08-03 12:58:01 UTC	2022-09-26 22:26:32 UTC	23.235.251.114	Unknown ranking
firefox.settings.services.mozilla.com (2)	867	2020-05-28 17:26:30 UTC	2022-09-26 18:38:08 UTC	143.204.55.35
snnl-glo.ketogermany.com (1)	0	2021-09-23 14:36:09 UTC	2022-09-26 04:00:03 UTC	52.58.131.39	Unknown ranking
push.services.mozilla.com (1)	2140	2015-09-03 10:29:36 UTC	2022-09-26 05:45:55 UTC	35.161.6.128
go.monetizer.mobi (6)	0	2016-04-21 22:02:55 UTC	2022-09-26 06:02:10 UTC	198.143.165.221	Unknown ranking
redir.findthewind.xyz (1)	0	2022-08-11 09:16:56 UTC	2022-09-26 21:42:11 UTC	198.211.113.186	Unknown ranking
so-glo.yoptv33.com (1)	0	2022-06-02 19:12:53 UTC	2022-09-27 01:06:06 UTC	3.64.246.59	Unknown ranking
www.wewillserv.com (3)	277919	2022-01-13 13:49:54 UTC	2022-09-26 12:53:38 UTC	51.68.81.31
ocsp.godaddy.com (1)	698	2012-05-20 19:28:57 UTC	2022-09-26 04:29:02 UTC	192.124.249.22
pollo.trffcsource.com (1)	195234	2021-09-13 15:04:31 UTC	2022-09-27 02:30:41 UTC	51.83.143.92

Scan Date	Severity	Indicator	Comment
2022-09-27	2	snnl-glo.ketogermany.com/t/clk	Malware

Date	UQ / IDS / BL	URL	IP
2022-10-08 15:29:14 +0000	0 - 0 - 3	rmut-glo.passionsearchnews.com/t/clk?id=qk49u (...)	52.58.131.39
2022-10-08 04:55:17 +0000	0 - 0 - 4	rmut-glo.passionsearchnews.com/t/clk	52.58.131.39
2022-10-08 02:30:39 +0000	0 - 0 - 2	rmut-glo.passionsearchnews.com/t/clk?id=qk49u (...)	52.58.131.39
2022-10-07 05:04:20 +0000	0 - 0 - 1	lltl-glo.usethisprice.com/t/clk	52.58.131.39
2022-10-06 12:58:27 +0000	0 - 0 - 1	rmut-glo.azurservers.com/t/clk	52.58.131.39

Date	UQ / IDS / BL	URL	IP
2023-01-30 18:08:50 +0000	0 - 0 - 6	pro-mobi.net/2sp/mob/ng/mp60569sweep/age21-bt (...)	54.230.111.67
2023-01-30 18:06:26 +0000	0 - 2 - 0	d3ry3spu9wn6vo.cloudfront.net/files/6uigc7sn2 (...)	54.230.245.116
2023-01-30 17:53:58 +0000	0 - 0 - 4	gifinate-loggage.com/7504d95a-63fe-4e1c-8d14- (...)	18.194.134.212
2023-01-30 17:53:02 +0000	0 - 3 - 0	cdn.korg.com/jp/support/download/files/b91ca5 (...)	54.230.111.71
2023-01-30 17:45:27 +0000	0 - 2 - 0	timify-desktop-app.s3.eu-central-1.amazonaws. (...)	3.5.137.173

Date	UQ / IDS / BL	URL	IP
2023-01-11 03:04:21 +0000	0 - 0 - 1	snnl-glo.ketogermany.com/t/clk	18.196.253.76
2022-10-17 03:08:20 +0000	0 - 0 - 1	snnl-glo.ketogermany.com/t/clk	18.195.30.40
2022-09-27 04:00:22 +0000	0 - 0 - 1	snnl-glo.ketogermany.com/t/clk	52.58.131.39
2022-09-21 04:00:24 +0000	0 - 0 - 1	snnl-glo.ketogermany.com/t/clk	52.58.131.39

Date	UQ / IDS / BL	URL	IP
2023-01-30 18:09:42 +0000	0 - 0 - 2	0pspzwa.informationnoisy.co.in/23525664356232 (...)	185.246.221.60
2023-01-30 17:49:45 +0000	0 - 0 - 1	www.drop-box.com/home/_2_Resources/_HALO/	173.255.194.134
2023-01-30 16:36:12 +0000	0 - 0 - 2	equitydefault.com/f8tqza89r1?yqvim=0&refer=eu (...)	192.243.61.225
2023-01-30 15:35:25 +0000	0 - 0 - 3	clubdao.com.cn/all/sign.php?authenticated=tru (...)	155.94.129.146
2023-01-30 14:47:06 +0000	0 - 0 - 3	dental-drawer.pro/YrWcRe4.RxXth/wZbzGz9_yXZUX (...)	188.72.219.36

Request	Response
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.77.32 HASH: 4397e6b45b5822fbab9b83abe0b96ee70efba7cd2160b51936159865ede5fdb1 23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "4397E6B45B5822FBAB9B83ABE0B96EE70EFBA7CD2160B51936159865EDE5FDB1" Last-Modified: Sun, 25 Sep 2022 18:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=19966 Expires: Tue, 27 Sep 2022 09:32:56 GMT Date: Tue, 27 Sep 2022 04:00:10 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: d2560f62890e75b8de444fed96c22f52 Sha1: 334ce0c48e606ee029f31eeb1463af87b1024bb9 Sha256: 4397e6b45b5822fbab9b83abe0b96ee70efba7cd2160b51936159865ede5fdb1
GET /v1/ HTTP/1.1 Host: firefox.settings.services.mozilla.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: firefox.settings.services.mozilla.com/v1/ FQDN: firefox.settings.services.mozilla.com IP: 143.204.55.35 HASH: 73c273c0b5a2de3cb970b8e8c187999d3b55e760dc7766dab4bb76428d19b551 143.204.55.35 HTTP/1.1 200 OK Content-Type: application/json Content-Length: 939 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length, Backoff, Content-Type, Retry-After, Alert Cache-Control: max-age=3600 Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none'; Date: Tue, 27 Sep 2022 03:15:30 GMT X-Content-Type-Options: nosniff X-Cache: Hit from cloudfront Via: 1.1 aac54e3fe9825ce24d51e0204433c2c0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: OSL50-C1 X-Amz-Cf-Id: ugzwGV8zz7GyOVSWvkan5EoacsZkOFR3KJWFYn9ShXAeNQDgfueBpw== Age: 2680 --- Additional Info --- Magic: JSON data\012- , ASCII text, with very long lines (939), with no line terminators Size: 939 Md5: 2d12f67fe57a87e7366b662d153a5582 Sha1: d7b02d81cc74f24a251d9363e0f4b0a149264ec1 Sha256: 73c273c0b5a2de3cb970b8e8c187999d3b55e760dc7766dab4bb76428d19b551
GET /chains/remote-settings.content-signature.mozilla.org-2022-10-30-18-47-44.chain HTTP/1.1 Host: content-signature-2.cdn.mozilla.net User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: no-cors Sec-Fetch-Site: cross-site	URL: content-signature-2.cdn.mozilla.net/chains/remote-setti (...) FQDN: content-signature-2.cdn.mozilla.net IP: 143.204.55.25 HASH: b6e0cc9ad68306208a160f3835fb8da76acc5a82d8fde1da5a98e1de1c11a770 143.204.55.25 HTTP/2 200 OK content-type: binary/octet-stream content-length: 5348 last-modified: Sat, 10 Sep 2022 18:47:45 GMT content-disposition: attachment accept-ranges: bytes server: AmazonS3 date: Mon, 26 Sep 2022 04:35:16 GMT etag: "6113f8408c59aebe188d6af273b90743" x-cache: Hit from cloudfront via: 1.1 a034aae43a19aef875fa395182990970.cloudfront.net (CloudFront) x-amz-cf-pop: OSL50-C1 x-amz-cf-id: KySloWSbk2usboeceRkPGQKw73v_AGzaOJCTKx9zMh8VMK7JephpLg== age: 84295 X-Firefox-Spdy: h2 --- Additional Info --- Magic: PEM certificate\012- , ASCII text Size: 5348 Md5: 6113f8408c59aebe188d6af273b90743 Sha1: 7398873bf00f99944eaa77ad3ebc0d43c23dba6b Sha256: b6e0cc9ad68306208a160f3835fb8da76acc5a82d8fde1da5a98e1de1c11a770
GET /v1/tiles HTTP/1.1 Host: contile.services.mozilla.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: contile.services.mozilla.com/v1/tiles FQDN: contile.services.mozilla.com IP: 34.117.237.239 HASH: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3 34.117.237.239 HTTP/2 200 OK content-type: application/json server: nginx date: Tue, 27 Sep 2022 04:00:10 GMT content-length: 12 strict-transport-security: max-age=31536000 via: 1.1 google alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JSON data\012- , ASCII text, with no line terminators Size: 12 Md5: 23e88fb7b99543fb33315b29b1fad9d6 Sha1: a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 Host: firefox.settings.services.mozilla.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: application/json Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Type: application/json Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: firefox.settings.services.mozilla.com/v1/buckets/main/c (...) FQDN: firefox.settings.services.mozilla.com IP: 143.204.55.35 HASH: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300 143.204.55.35 HTTP/1.1 200 OK Content-Type: application/json Content-Length: 329 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Expose-Headers: ETag, Expires, Content-Length, Cache-Control, Pragma, Content-Type, Alert, Backoff, Last-Modified, Retry-After Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none'; Last-Modified: Fri, 25 Mar 2022 17:45:46 GMT Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff Date: Tue, 27 Sep 2022 03:10:46 GMT Cache-Control: max-age=3600, max-age=3600 Expires: Tue, 27 Sep 2022 03:36:19 GMT ETag: "1648230346554" X-Cache: Hit from cloudfront Via: 1.1 96c778ce6156d12f24b8b6cdaa0cbf66.cloudfront.net (CloudFront) X-Amz-Cf-Pop: OSL50-C1 X-Amz-Cf-Id: OuapsLjFAqFKaFFTYJtssbQxPdjwtBFkkO_IZsHU5pe7lxLnH5uqBw== Age: 2965 --- Additional Info --- Magic: JSON data\012- , ASCII text, with very long lines (329), with no line terminators Size: 329 Md5: 0333b0655111aa68de771adfcc4db243 Sha1: 63f295a144ac87a7c8e23417626724eeca68a7eb Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
POST / HTTP/1.1 Host: ocsp.digicert.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 83 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: ocsp.digicert.com/ FQDN: ocsp.digicert.com IP: 93.184.220.29 HASH: 5c95ba48bc342887b4f7ef697bd4def50f6f2f472f654169179e5ac44df883d9 93.184.220.29 HTTP/1.1 200 OK Content-Type: application/ocsp-response Accept-Ranges: bytes Age: 3106 Cache-Control: 'max-age=158059' Date: Tue, 27 Sep 2022 04:00:11 GMT Last-Modified: Tue, 27 Sep 2022 03:08:25 GMT Server: ECS (ska/F710) X-Cache: HIT Content-Length: 471 --- Additional Info --- Magic: data Size: 471 Md5: 5adb7eb1d103eadeeafac36e663ffdd3 Sha1: 23b784388dd634fa736cd60aed71570661e73d02 Sha256: 5c95ba48bc342887b4f7ef697bd4def50f6f2f472f654169179e5ac44df883d9
GET /t/clk HTTP/1.1 Host: snnl-glo.ketogermany.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Upgrade-Insecure-Requests: 1	URL: snnl-glo.ketogermany.com/t/clk FQDN: snnl-glo.ketogermany.com IP: 52.58.131.39 HASH: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 52.58.131.39 HTTP/1.1 302 Found Content-Type: text/html; charset=utf-8 Date: Tue, 27 Sep 2022 04:00:11 GMT Content-Length: 0 Connection: keep-alive Server: nginx/1.12.2 Location: https://so-glo.yoptv33.com/t/clk?id=DQqT5fxjrUGKRmCl&rl=Dkxpn&rcode=R09&rseq=R09,R99,R98 Vary: Cookie, Origin --- Additional Info --- Magic: Size: 0 Md5: d41d8cd98f00b204e9800998ecf8427e Sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Alerts: Blocklists: - fortinet: Malware
GET / HTTP/1.1 Host: push.services.mozilla.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Sec-WebSocket-Version: 13 Origin: wss://push.services.mozilla.com/ Sec-WebSocket-Protocol: push-notification Sec-WebSocket-Extensions: permessage-deflate Sec-WebSocket-Key: FqQgKXJW13snPaaNvoshFQ== Connection: keep-alive, Upgrade Sec-Fetch-Dest: websocket Sec-Fetch-Mode: websocket Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache Upgrade: websocket	URL: push.services.mozilla.com/ FQDN: push.services.mozilla.com IP: 35.161.6.128 HASH: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 35.161.6.128 HTTP/1.1 101 Switching Protocols Connection: Upgrade Upgrade: websocket Sec-WebSocket-Accept: OgPT6lw1T8hHaJ7nhrJlT2eXda8= --- Additional Info --- Magic: Size: 0 Md5: d41d8cd98f00b204e9800998ecf8427e Sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST / HTTP/1.1 Host: ocsp.sca1b.amazontrust.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 83 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: ocsp.sca1b.amazontrust.com/ FQDN: ocsp.sca1b.amazontrust.com IP: 143.204.42.158 HASH: 4465f1d030be739d1f111b6c3811c2925997dd20e330c7e41abe3d69f1c4226a 143.204.42.158 HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 471 Connection: keep-alive Cache-Control: 'max-age=158059' Date: Tue, 27 Sep 2022 04:00:11 GMT Server: ECS (dcb/7F5E) X-Cache: Miss from cloudfront Via: 1.1 4f01f770085624552bc30a98954f963a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: OSL50-C1 X-Amz-Cf-Id: 8BEMJf4aNWoMpJ06bqMPk6yOeohu0YVHddRc-EEokfThHcokjKmMQg== --- Additional Info --- Magic: data Size: 471 Md5: 53a9e2273b299b9f4b72749b85699599 Sha1: 5e55ec2164eb8fea16d96731c6a4cc93e8094ad2 Sha256: 4465f1d030be739d1f111b6c3811c2925997dd20e330c7e41abe3d69f1c4226a
GET /t/clk?id=DQqT5fxjrUGKRmCl&rl=Dkxpn&rcode=R09&rseq=R09,R99,R98 HTTP/1.1 Host: so-glo.yoptv33.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Cookie: uip="[\"m1rJNX2\"\054 {\"oza1p\": \"2z2QePl\"}]:1od0x6:JESxrUhz4apRU0DQzrbjbi5c8Ts"; ydt_69a756d9a2a44370a5365f82fbdfa6e5="[\"d758bcaf-a484-4b92-96ff-6aa9838e7c68\"]:1od0x6:KCDPlU55OnobBV1GE_-xqLsiCDo" Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: none Sec-Fetch-User: ?1	URL: so-glo.yoptv33.com/t/clk?id=DQqT5fxjrUGKRmCl&rl=Dkxpn&r (...) FQDN: so-glo.yoptv33.com IP: 3.64.246.59 HASH: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 3.64.246.59 HTTP/2 302 Found content-type: text/html; charset=utf-8 date: Tue, 27 Sep 2022 04:00:12 GMT content-length: 0 location: https://go.monetizer.mobi/?utm_medium=ec4eee60be986151ad56a07d62a9c3fe7802b9db&utm_campaign=mainstream2021&1=1&cid=0b5d3df1-ff7c-4d7c-bf13-c29134ec1ce2 server: nginx/1.12.2 cache-control: no-transform x-frame-options: SAMEORIGIN vary: Cookie, Origin set-cookie: uip="[\"m1rJNX2\"\054 {\"oza1p\": \"2z2QePl\"}]:1od1lU:BRtUwQWRkRTSjmCLQ2G0l8OzCCA"; expires=Thu, 27 Oct 2022 04:00:12 GMT; Max-Age=2592000; Path=/ ydt_69a756d9a2a44370a5365f82fbdfa6e5="[\"d758bcaf-a484-4b92-96ff-6aa9838e7c68\"\054 \"0b5d3df1-ff7c-4d7c-bf13-c29134ec1ce2\"]:1od1lU:fzgWtJSRH6tfOQv9MkV8iyH-FG8"; expires=Thu, 27 Oct 2022 06:00:12 GMT; Max-Age=2599200; Path=/; SameSite=None; Secure X-Firefox-Spdy: h2 --- Additional Info --- Magic: Size: 0 Md5: d41d8cd98f00b204e9800998ecf8427e Sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.77.32 HASH: 519e9b47ddfa1e1fe047f4dc7df88e3011817f88144fcc3853a7984a781c2070 23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "519E9B47DDFA1E1FE047F4DC7DF88E3011817F88144FCC3853A7984A781C2070" Last-Modified: Sun, 25 Sep 2022 22:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=3368 Expires: Tue, 27 Sep 2022 04:56:21 GMT Date: Tue, 27 Sep 2022 04:00:13 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 5a6097201b7da81f6e9a6d99a7353a0c Sha1: d4240fe80c76013b9f7b6fd09963aa47151b8d6a Sha256: 519e9b47ddfa1e1fe047f4dc7df88e3011817f88144fcc3853a7984a781c2070
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.77.32 HASH: 519e9b47ddfa1e1fe047f4dc7df88e3011817f88144fcc3853a7984a781c2070 23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "519E9B47DDFA1E1FE047F4DC7DF88E3011817F88144FCC3853A7984A781C2070" Last-Modified: Sun, 25 Sep 2022 22:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=3368 Expires: Tue, 27 Sep 2022 04:56:21 GMT Date: Tue, 27 Sep 2022 04:00:13 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 5a6097201b7da81f6e9a6d99a7353a0c Sha1: d4240fe80c76013b9f7b6fd09963aa47151b8d6a Sha256: 519e9b47ddfa1e1fe047f4dc7df88e3011817f88144fcc3853a7984a781c2070
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.77.32 HASH: 519e9b47ddfa1e1fe047f4dc7df88e3011817f88144fcc3853a7984a781c2070 23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "519E9B47DDFA1E1FE047F4DC7DF88E3011817F88144FCC3853A7984A781C2070" Last-Modified: Sun, 25 Sep 2022 22:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=3368 Expires: Tue, 27 Sep 2022 04:56:21 GMT Date: Tue, 27 Sep 2022 04:00:13 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 5a6097201b7da81f6e9a6d99a7353a0c Sha1: d4240fe80c76013b9f7b6fd09963aa47151b8d6a Sha256: 519e9b47ddfa1e1fe047f4dc7df88e3011817f88144fcc3853a7984a781c2070
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ffffd9a36-7835-4249-a213-06720f62ce54.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: img-getpocket.cdn.mozilla.net/296x148/filters:format(jp (...) FQDN: img-getpocket.cdn.mozilla.net IP: 34.120.237.76 HASH: 4382f21ee6727d4b4d21bd7d16b1821a57d9fec6c78dbf7e74bfdfbde51ec206 34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 4327 x-amzn-requestid: 59493149-3c46-42c6-96aa-92c945fb4c40 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: ZFlA1HzioAMFzxw= x-content-type-options: nosniff x-amzn-trace-id: Root=1-63321b9e-5bd13d5719a119a25650f405;Sampled=0 x-amzn-remapped-date: Mon, 26 Sep 2022 21:37:34 GMT x-amz-cf-pop: HIO50-C1, SEA73-P1 x-cache: Miss from cloudfront x-amz-cf-id: 5XQYaLxNwxhN9NCIoDYRbt8U-2Tsxcx-2SqPNr64Z4YV8Bk7Eayjfg== via: 1.1 0c96ded7ff282d2dbcf47c918b6bb500.cloudfront.net (CloudFront), 1.1 6396e88c437c096ef98930ce29f731a2.cloudfront.net (CloudFront), 1.1 google date: Mon, 26 Sep 2022 21:38:57 GMT age: 22876 etag: "a92af0438aa2b6637c0f69dabd0be00b3a43caf8" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 4327 Md5: f9bc23ab347b5f2e2ec15d69f41f0cf0 Sha1: a92af0438aa2b6637c0f69dabd0be00b3a43caf8 Sha256: 4382f21ee6727d4b4d21bd7d16b1821a57d9fec6c78dbf7e74bfdfbde51ec206
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F14ab4d12-a7de-4708-a657-df4600198640.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: img-getpocket.cdn.mozilla.net/296x148/filters:format(jp (...) FQDN: img-getpocket.cdn.mozilla.net IP: 34.120.237.76 HASH: 8c974283b2ba0058114404af3e4818daa8cc56f270cb8a46f5f2f54de9d2f0e1 34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 8255 x-amzn-requestid: 3bf29c4a-406a-4645-ad18-44cd6f05d457 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: Y4VnFEV-IAMFQMQ= x-content-type-options: nosniff x-amzn-trace-id: Root=1-632ccfc6-3eaa337d1e1c1b6d5e951419;Sampled=0 x-amzn-remapped-date: Thu, 22 Sep 2022 21:12:38 GMT x-amz-cf-pop: SEA73-P1 x-cache: Hit from cloudfront x-amz-cf-id: X-6P09-hgjmDFe4Y7P1KnXtJAuvJNen8XsBVIexf521SOxMivJ4t7A== via: 1.1 2afae0d44e2540f472c0635ab62c232a.cloudfront.net (CloudFront), 1.1 989017835f43d594873bde5a7ee7fe5e.cloudfront.net (CloudFront), 1.1 google date: Mon, 26 Sep 2022 17:53:33 GMT age: 36400 etag: "04a0665f771562c3e56ac3542abe5bd3c4c1a6b5" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 8255 Md5: fa70ece15044b7318cb11ae5e37a64e7 Sha1: 04a0665f771562c3e56ac3542abe5bd3c4c1a6b5 Sha256: 8c974283b2ba0058114404af3e4818daa8cc56f270cb8a46f5f2f54de9d2f0e1
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb5538bec-989b-434a-bf80-699456665fd7.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: img-getpocket.cdn.mozilla.net/296x148/filters:format(jp (...) FQDN: img-getpocket.cdn.mozilla.net IP: 34.120.237.76 HASH: 8a1968c18b44495571ff382a9cacfb7f98d3e1275d650e84cb310d635eae7e70 34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 6829 x-amzn-requestid: cc3229a7-7c7e-472b-b7a4-1216594c4068 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: Yshb2FwhoAMF2EA= x-content-type-options: nosniff x-amzn-trace-id: Root=1-632815e5-0964e463192712fb08a29ee7;Sampled=0 x-amzn-remapped-date: Mon, 19 Sep 2022 07:10:29 GMT x-amz-cf-pop: SEA73-P1 x-cache: Hit from cloudfront x-amz-cf-id: 38UTZEh7vpUlYc9mGIdNrIy4fgLQf4iErqzZLY5mM5fdMQwvJvoBvQ== via: 1.1 112c6b3f9aea37a6cb00b7d933e5af6e.cloudfront.net (CloudFront), 1.1 5397b304713f6301c7c94ac084b6ed08.cloudfront.net (CloudFront), 1.1 google date: Mon, 26 Sep 2022 22:12:45 GMT age: 20848 etag: "c80d9ce02eeaa7b0166a696e811d2cffde4997d0" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 6829 Md5: 62ece01d7e0036711832df5a25175b3b Sha1: c80d9ce02eeaa7b0166a696e811d2cffde4997d0 Sha256: 8a1968c18b44495571ff382a9cacfb7f98d3e1275d650e84cb310d635eae7e70
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5bf02f4e-91c0-455b-8378-5eae82174db7.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: img-getpocket.cdn.mozilla.net/296x148/filters:format(jp (...) FQDN: img-getpocket.cdn.mozilla.net IP: 34.120.237.76 HASH: f7488246ca75fddc504812f4c5944a5a2494cdb14b6ef1db5fb28beca5cff194 34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 9737 x-amzn-requestid: a06488e4-22bb-4149-adac-b6696ab91923 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: ZFlATHzUIAMFtcw= x-content-type-options: nosniff x-amzn-trace-id: Root=1-63321b9b-238f1b945a8b549872c85f2a;Sampled=0 x-amzn-remapped-date: Mon, 26 Sep 2022 21:37:31 GMT x-amz-cf-pop: HIO50-C1, SEA73-P1 x-cache: Miss from cloudfront x-amz-cf-id: qkfz02g1BMeZhFonJAWyqyQ9jBnZC4i-2ZHzO2wgJBVjC4YfvtlxCA== via: 1.1 000f4a2f631bace380a0afa747a82482.cloudfront.net (CloudFront), 1.1 e80693c02cfdfd081110512210d57840.cloudfront.net (CloudFront), 1.1 google date: Mon, 26 Sep 2022 21:38:57 GMT age: 22876 etag: "932c74fa24b61ee1b1c672b6c19b1e736caab8d3" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 9737 Md5: 3140ec95f33c36599de95b25cdade940 Sha1: 932c74fa24b61ee1b1c672b6c19b1e736caab8d3 Sha256: f7488246ca75fddc504812f4c5944a5a2494cdb14b6ef1db5fb28beca5cff194
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.77.32 HASH: 519e9b47ddfa1e1fe047f4dc7df88e3011817f88144fcc3853a7984a781c2070 23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "519E9B47DDFA1E1FE047F4DC7DF88E3011817F88144FCC3853A7984A781C2070" Last-Modified: Sun, 25 Sep 2022 22:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=3368 Expires: Tue, 27 Sep 2022 04:56:21 GMT Date: Tue, 27 Sep 2022 04:00:13 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 5a6097201b7da81f6e9a6d99a7353a0c Sha1: d4240fe80c76013b9f7b6fd09963aa47151b8d6a Sha256: 519e9b47ddfa1e1fe047f4dc7df88e3011817f88144fcc3853a7984a781c2070
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.77.32 HASH: 519e9b47ddfa1e1fe047f4dc7df88e3011817f88144fcc3853a7984a781c2070 23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "519E9B47DDFA1E1FE047F4DC7DF88E3011817F88144FCC3853A7984A781C2070" Last-Modified: Sun, 25 Sep 2022 22:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=3368 Expires: Tue, 27 Sep 2022 04:56:21 GMT Date: Tue, 27 Sep 2022 04:00:13 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 5a6097201b7da81f6e9a6d99a7353a0c Sha1: d4240fe80c76013b9f7b6fd09963aa47151b8d6a Sha256: 519e9b47ddfa1e1fe047f4dc7df88e3011817f88144fcc3853a7984a781c2070
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F79631135-a10c-43bf-85d2-fa2236b96883.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: img-getpocket.cdn.mozilla.net/296x148/filters:format(jp (...) FQDN: img-getpocket.cdn.mozilla.net IP: 34.120.237.76 HASH: 058d798963f83f5fb88ab728185f755c5353fa981d93e1b6ff869089f501586b 34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 13213 x-amzn-requestid: fe9ec409-2757-4910-8443-5b4d3be7efd3 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: ZFlATEp8oAMFd9Q= x-content-type-options: nosniff x-amzn-trace-id: Root=1-63321b9b-3230e97a4fe34413285eb578;Sampled=0 x-amzn-remapped-date: Mon, 26 Sep 2022 21:37:31 GMT x-amz-cf-pop: HIO50-C1, SEA73-P1 x-cache: Miss from cloudfront x-amz-cf-id: kRSg9NTTAgeAJgIZ_C9_rRodCX4bzGduJEvNPNHUya0Moa2vsmWSoQ== via: 1.1 c7c3cdef911c9ee3c1a83a78f425dc5a.cloudfront.net (CloudFront), 1.1 2324edbcb8fc72f617442c65f36a40fc.cloudfront.net (CloudFront), 1.1 google date: Mon, 26 Sep 2022 21:38:57 GMT age: 22876 etag: "3d4fa8701f17e8818c25584ef5f04bfbee8440cd" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 13213 Md5: 62e68c3cd08dd94d910507512a67e85f Sha1: 3d4fa8701f17e8818c25584ef5f04bfbee8440cd Sha256: 058d798963f83f5fb88ab728185f755c5353fa981d93e1b6ff869089f501586b
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe29cee89-5693-407a-b182-e52f8fe5734f.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: img-getpocket.cdn.mozilla.net/296x148/filters:format(jp (...) FQDN: img-getpocket.cdn.mozilla.net IP: 34.120.237.76 HASH: eebf3b550e7a675a2231e97575e8be57e8d1216126a711cdef73ccbc5dd1e773 34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 11885 x-amzn-requestid: a8f6d57a-8bd3-42b9-80ba-695c5baac04b x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: YshLpHZPIAMFZiQ= x-content-type-options: nosniff x-amzn-trace-id: Root=1-6328157d-4ef5eb306dde741502e46f24;Sampled=0 x-amzn-remapped-date: Mon, 19 Sep 2022 07:08:45 GMT x-amz-cf-pop: SEA19-C2 x-cache: Hit from cloudfront x-amz-cf-id: JSWNUGbYq_zNf2L2AwkLuPfnGUTsX6iqCB5ESRr3dX-0voDgtu4KnQ== via: 1.1 0c96ded7ff282d2dbcf47c918b6bb500.cloudfront.net (CloudFront), 1.1 d8792dbd3191bbe722eba5b536b979c8.cloudfront.net (CloudFront), 1.1 google date: Mon, 26 Sep 2022 21:56:23 GMT age: 21830 etag: "03edfe254fa4f5c88bf9c8868edd9cdf07bf5d0d" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 11885 Md5: 1f0a1508f459d7774c0d63ff682532c0 Sha1: 03edfe254fa4f5c88bf9c8868edd9cdf07bf5d0d Sha256: eebf3b550e7a675a2231e97575e8be57e8d1216126a711cdef73ccbc5dd1e773
GET /favicon.ico HTTP/1.1 Host: go.monetizer.mobi User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://go.monetizer.mobi/?utm_term=7147904527885140061&ver=4viyaptcjo&utm_content=e6c2c6dcd68fd49594fc9695a6a79597828bb8888e8f8ebdb2c6b0c4b6b78587b2bb88b0bdb68cbd82b280b3b6b6bcb4aaaba9a9aeafacada293a1919697f8f4848f9b8a8f9f89c09291898c87959de5cbfbf8cbcaffcec9f2f3f085848291f5cafac8f8fcf7fccdf3f3f2f5c6c7c4c5dae8edebe8ebebebebebe6e2e0efece61b84 Cookie: u=17efd21951c8f38faa309233e309fc3a Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin TE: trailers	URL: go.monetizer.mobi/favicon.ico FQDN: go.monetizer.mobi IP: 198.143.165.221 HASH: b1d7aef06456fe7431124129a28f0138bb5fccfa4f4161e3087de23c005e5edc 198.143.165.221 HTTP/2 200 OK content-type: image/x-icon server: nginx date: Tue, 27 Sep 2022 04:00:13 GMT content-length: 1150 last-modified: Wed, 31 Jul 2019 07:48:51 GMT etag: "5d4147e3-47e" expires: Wed, 28 Sep 2022 04:00:13 GMT cache-control: max-age=86400 strict-transport-security: max-age=31536000; includeSubdomains; accept-ranges: bytes X-Firefox-Spdy: h2 --- Additional Info --- Magic: MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel\012- data Size: 1150 Md5: 91abe01116ab422c598e9c8af72cf4da Sha1: 0f2815fe8e067d48537ad168225ab4674271fa27 Sha256: b1d7aef06456fe7431124129a28f0138bb5fccfa4f4161e3087de23c005e5edc
GET /sw.js?v=1664251211093 HTTP/1.1 Host: go.monetizer.mobi User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Service-Worker: script Connection: keep-alive Cookie: u=17efd21951c8f38faa309233e309fc3a Sec-Fetch-Dest: serviceworker Sec-Fetch-Mode: same-origin Sec-Fetch-Site: same-origin Pragma: no-cache Cache-Control: no-cache TE: trailers	URL: go.monetizer.mobi/sw.js?v=1664251211093 FQDN: go.monetizer.mobi IP: 198.143.165.221 HASH: 70d55f6e4bab19ae4b3cc61642e88a78a599b060c72d10c15c5f937e34305ee9 198.143.165.221 HTTP/2 200 OK content-type: application/javascript server: nginx date: Tue, 27 Sep 2022 04:00:13 GMT content-length: 775 last-modified: Fri, 23 Sep 2022 11:12:42 GMT vary: Accept-Encoding etag: "632d94aa-307" content-encoding: gzip content-security-policy: default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src ; style-src 'unsafe-inline'; X-Firefox-Spdy: h2 --- Additional Info --- Magic: ASCII text Size: 775 Md5: de06f24ba6d6b0c514015a9847dace54 Sha1: c9662e4339d4f72af3526b21d4d6d68df21b0ba9 Sha256: 70d55f6e4bab19ae4b3cc61642e88a78a599b060c72d10c15c5f937e34305ee9
GET /?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7147904527885140061&website=797-403c551a&placement=797&utm_content=e6c2c6dcd68fd49594fc9695a6a79597828bb8888e8f8ebdb2c6b0c4b6b78587b2bb88b0bdb68cbd82b380b3b6b6bcb4aaaba9a9aeafacada293a1919697f8f4848f9b8a8f9f89c09291898c87959de5cbfbf8cbcaffcec9f2f3f085848291f5cafac8f8fcf7fccdf3f3f2f5c6c7c4c5dae8edebe8ebebebebebe6e2e0efece61b85 HTTP/1.1 Host: www.wewillserv.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://go.monetizer.mobi/ Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site	URL: www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2 (...) FQDN: www.wewillserv.com IP: 51.68.81.31 HASH: 041fbdf14ad1fb7f260c19e6be638b293ae6a761897ef98ef72b2c86065e8ea9 51.68.81.31 HTTP/1.1 200 OK Content-Type: text/html Date: Tue, 27 Sep 2022 04:00:13 GMT Transfer-Encoding: chunked Connection: keep-alive Cache-Control: no-transform --- Additional Info --- Magic: HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (3751) Size: 5152 Md5: 2bd509794d9e5146dfe092ddb127ae8f Sha1: ccdba35d96704f46c044b60ee1fbbda001debd6b Sha256: 041fbdf14ad1fb7f260c19e6be638b293ae6a761897ef98ef72b2c86065e8ea9
GET /proc.php?7aa6b76bb7b1da2c08e2a6b2bb8679cb3b55ffa0 HTTP/1.1 Host: go.monetizer.mobi User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://go.monetizer.mobi/?utm_term=7147904527885140061&ver=4viyaptcjo&utm_content=e6c2c6dcd68fd49594fc9695a6a79597828bb8888e8f8ebdb2c6b0c4b6b78587b2bb88b0bdb68cbd82b280b3b6b6bcb4aaaba9a9aeafacada293a1919697f8f4848f9b8a8f9f89c09291898c87959de5cbfbf8cbcaffcec9f2f3f085848291f5cafac8f8fcf7fccdf3f3f2f5c6c7c4c5dae8edebe8ebebebebebe6e2e0efece61b84 Cookie: u=17efd21951c8f38faa309233e309fc3a Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-origin TE: trailers	URL: go.monetizer.mobi/proc.php?7aa6b76bb7b1da2c08e2a6b2bb86 (...) FQDN: go.monetizer.mobi IP: 198.143.165.221 HASH: 71d28f8108b8a08eaf246fffd8268fe2fa5acd82dc9118ac430bea14dc484393 198.143.165.221 HTTP/2 200 OK content-type: text/html; charset=UTF-8 server: nginx date: Tue, 27 Sep 2022 04:00:13 GMT location: https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7147904527885140061&website=797-403c551a&placement=797 vary: Accept-Encoding x-powered-by: PHP/8.1.9 cache-control: no-store, no-cache, must-revalidate, max-age=0 pragma: no-cache expires: Thu, 01 Jan 1970 00:00:00 GMT strict-transport-security: max-age=31536000; includeSubdomains; content-encoding: gzip X-Firefox-Spdy: h2 --- Additional Info --- Magic: HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (3576), with no line terminators Size: 1547 Md5: e8a161691d32b04983d78a4c6e12e2c7 Sha1: 5a9e72ad05ec548943406810555e5a78fdfd7e58 Sha256: 71d28f8108b8a08eaf246fffd8268fe2fa5acd82dc9118ac430bea14dc484393
GET /?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7147904527885140061&website=797-403c551a&placement=797&utm_content=e6c2c6dcd68fd49594fc9695a6a79597828bb8888e8f8ebdb2c6b0c4b6b78587b2bb88b0bdb68cbd82b380b3b6b6bcb4aaaba9a9aeafacada293a1919697f8f4848f9b8a8f9f89c09291898c87959de5cbfbf8cbcaffcec9f2f3f085848291f5cafac8f8fcf7fccdf3f3f2f5c6c7c4c5dae8edebe8ebebebebebe6e2e0efece61b85&eyeg=3&eyer=0.6918226252601117&eyei=0&eyew=1280&eyeh=939&eyetd=220&eyef=go.monetizer.mobi HTTP/1.1 Host: www.wewillserv.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-origin	URL: www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2 (...) FQDN: www.wewillserv.com IP: 51.68.81.31 HASH: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 51.68.81.31 HTTP/1.1 302 Found Date: Tue, 27 Sep 2022 04:00:13 GMT Content-Length: 0 Connection: keep-alive Cache-Control: no-transform Location: https://admoustache.go2affise.com/sl?id=5f0efd61dabed1d602e0fe6a&pid=503&sub1=33000c5a0391e8ccfbbcca9e9f7408d9202e70927-202209-flb5467509-4538fM7147904527885140061sl_5467509-4538fdccb0a3cb6b4a731440efcb68deaa526e1f89153797-403c551a797 --- Additional Info --- Magic: Size: 0 Md5: d41d8cd98f00b204e9800998ecf8427e Sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /favicon.ico HTTP/1.1 Host: www.wewillserv.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin	URL: www.wewillserv.com/favicon.ico FQDN: www.wewillserv.com IP: 51.68.81.31 HASH: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 51.68.81.31 HTTP/1.1 204 No Content Server: openresty Date: Tue, 27 Sep 2022 04:00:13 GMT Connection: keep-alive --- Additional Info --- Magic: Size: 0 Md5: d41d8cd98f00b204e9800998ecf8427e Sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /sw.js?v=1664251211093 HTTP/1.1 Host: go.monetizer.mobi User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Service-Worker: script Connection: keep-alive Cookie: u=17efd21951c8f38faa309233e309fc3a Sec-Fetch-Dest: serviceworker Sec-Fetch-Mode: same-origin Sec-Fetch-Site: same-origin If-Modified-Since: Fri, 23 Sep 2022 11:12:42 GMT If-None-Match: "632d94aa-307" Cache-Control: max-age=0 TE: trailers	URL: go.monetizer.mobi/sw.js?v=1664251211093 FQDN: go.monetizer.mobi IP: 198.143.165.221 HASH: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 198.143.165.221 HTTP/2 304 Not Modified server: nginx date: Tue, 27 Sep 2022 04:00:14 GMT last-modified: Fri, 23 Sep 2022 11:12:42 GMT vary: Accept-Encoding etag: "632d94aa-307" content-security-policy: default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src ; style-src 'unsafe-inline'; X-Firefox-Spdy: h2 --- Additional Info --- Magic: Size: 0 Md5: d41d8cd98f00b204e9800998ecf8427e Sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /sl?id=5f0efd61dabed1d602e0fe6a&pid=503&sub1=33000c5a0391e8ccfbbcca9e9f7408d9202e70927-202209-flb5467509-4538fM7147904527885140061sl_5467509-4538fdccb0a3cb6b4a731440efcb68deaa526e1f89153797-403c551a797 HTTP/1.1 Host: admoustache.go2affise.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site	URL: admoustache.go2affise.com/sl?id=5f0efd61dabed1d602e0fe6 (...) FQDN: admoustache.go2affise.com IP: 34.90.46.36 HASH: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 34.90.46.36 HTTP/2 302 Found server: nginx date: Tue, 27 Sep 2022 04:00:14 GMT content-length: 0 location: https://t2.blowingwnd.com/l.php?p=c:o6450ylcdnn31butk&d=624e9ea3e8e2a8163b65d246&pid=6332754ea00dbc00017e8901&s=503 set-cookie: afclick=6332754ea00dbc00017e8901; expires=Wed, 27 Sep 2023 04:00:14 GMT; secure; SameSite=None access-control-allow-origin: * X-Firefox-Spdy: h2 --- Additional Info --- Magic: Size: 0 Md5: d41d8cd98f00b204e9800998ecf8427e Sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.77.32 HASH: 43169009e73d29c0b3a8c3b2f347f6428f965626816dc7dbabfe3ec5696cad73 23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "43169009E73D29C0B3A8C3B2F347F6428F965626816DC7DBABFE3EC5696CAD73" Last-Modified: Mon, 26 Sep 2022 05:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=2302 Expires: Tue, 27 Sep 2022 04:38:37 GMT Date: Tue, 27 Sep 2022 04:00:15 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: cc72a8c7d266f8d71f59e2fd61a8525e Sha1: 5ab009686feb617b00586243e2ec3d5886aa302a Sha256: 43169009e73d29c0b3a8c3b2f347f6428f965626816dc7dbabfe3ec5696cad73
GET /l.php?p=c:o6450ylcdnn31butk&d=624e9ea3e8e2a8163b65d246&pid=6332754ea00dbc00017e8901&s=503 HTTP/1.1 Host: t2.blowingwnd.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site	URL: t2.blowingwnd.com/l.php?p=c:o6450ylcdnn31butk&d=624e9ea (...) FQDN: t2.blowingwnd.com IP: 51.161.115.163 HASH: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 51.161.115.163 HTTP/1.1 302 Found Content-Type: text/html; charset=UTF-8 Server: nginx Date: Tue, 27 Sep 2022 04:00:15 GMT Content-Length: 0 Connection: keep-alive Round: 12bbr5cth7 Raund: 19q Location: https://48.us.findthewind.xyz/feed/?link=true&tid=48&subid=48.503&ref=&s1=6332754f8f89a04a095b73bb --- Additional Info --- Magic: Size: 0 Md5: d41d8cd98f00b204e9800998ecf8427e Sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.77.32 HASH: 99220615d230816afb78af6779d62dae30c501d418376dcccb89edf27fb4de16 23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "99220615D230816AFB78AF6779D62DAE30C501D418376DCCCB89EDF27FB4DE16" Last-Modified: Mon, 26 Sep 2022 04:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=10836 Expires: Tue, 27 Sep 2022 07:00:51 GMT Date: Tue, 27 Sep 2022 04:00:15 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 5014bc7b4cfedcdef14c35d0baf07baa Sha1: 06a45f69abd312a3c793ee5b89836316b15851de Sha256: 99220615d230816afb78af6779d62dae30c501d418376dcccb89edf27fb4de16
POST / HTTP/1.1 Host: ocsp.godaddy.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 75 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: ocsp.godaddy.com/ FQDN: ocsp.godaddy.com IP: 192.124.249.22 HASH: 0d8438abd1a634d426bf658f2a5f383cfdbab8b6b12a37885895166d8328c7da 192.124.249.22 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: Sucuri/Cloudproxy Date: Tue, 27 Sep 2022 04:00:15 GMT Content-Length: 1777 Connection: keep-alive X-Sucuri-ID: 19022 Content-Transfer-Encoding: Binary Cache-Control: public, no-transform, must-revalidate Last-Modified: Mon, 26 Sep 2022 23:43:15 GMT Expires: Tue, 27 Sep 2022 23:43:15 GMT ETag: "49b873c2bff6f2eba87397c2ba244b04b3c317eb" P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA" --- Additional Info --- Magic: data Size: 1777 Md5: 98917b3482df1fb9b63778a65d8de247 Sha1: 49b873c2bff6f2eba87397c2ba244b04b3c317eb Sha256: 0d8438abd1a634d426bf658f2a5f383cfdbab8b6b12a37885895166d8328c7da
GET /feed/?link=true&tid=48&subid=48.503&ref=&s1=6332754f8f89a04a095b73bb HTTP/1.1 Host: 48.us.findthewind.xyz User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site	URL: 48.us.findthewind.xyz/feed/?link=true&tid=48&subid=48.5 (...) FQDN: 48.us.findthewind.xyz IP: 23.235.251.114 HASH: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 23.235.251.114 HTTP/1.1 301 Moved Permanently Cache-Control: no-cache Location: https://redir.findthewind.xyz/click/invalid/?tid=48&subid=48.503 Date: Tue, 27 Sep 2022 04:00:16 GMT Connection: keep-alive Keep-Alive: timeout=5 Transfer-Encoding: chunked --- Additional Info --- Magic: Size: 0 Md5: d41d8cd98f00b204e9800998ecf8427e Sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.77.32 HASH: 9845e12580cbfc6263681ae1307766dd0955b0698f4ba0a0a18527e9595d1d93 23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "9845E12580CBFC6263681AE1307766DD0955B0698F4BA0A0A18527E9595D1D93" Last-Modified: Mon, 26 Sep 2022 04:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=18109 Expires: Tue, 27 Sep 2022 09:02:06 GMT Date: Tue, 27 Sep 2022 04:00:17 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 747e5d0b7cb7686662a71efa89dc4bdd Sha1: 4d9630aadfb716491bd35632f8cd8ebf1b5af55c Sha256: 9845e12580cbfc6263681ae1307766dd0955b0698f4ba0a0a18527e9595d1d93
GET /click/invalid/?tid=48&subid=48.503 HTTP/1.1 Host: redir.findthewind.xyz User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site	URL: redir.findthewind.xyz/click/invalid/?tid=48&subid=48.503 FQDN: redir.findthewind.xyz IP: 198.211.113.186 HASH: 877fbd10ae194b887dfff2de0a0439cde4b33ac994d1dc1b325e3eaac79f1c38 198.211.113.186 HTTP/1.1 302 Found Content-Type: text/html; charset=utf-8 X-Powered-By: Express Surrogate-Control: no-store Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate Pragma: no-cache Expires: 0 Location: https://cola.labtrffc.com/r.php?p=c:xecd97ullhqs49nas&d=62a055db84c90235f05e05a1&s=48 Vary: Accept Content-Length: 230 Date: Tue, 27 Sep 2022 04:00:17 GMT Connection: keep-alive Keep-Alive: timeout=5 --- Additional Info --- Magic: HTML document, ASCII text, with no line terminators Size: 230 Md5: 90febcb2a62ac7e4149297e66bf35f2e Sha1: d998f49976838f36db5ec5f8bee47f0ff6e1ddb3 Sha256: 877fbd10ae194b887dfff2de0a0439cde4b33ac994d1dc1b325e3eaac79f1c38
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.77.32 HASH: 6bb345b76a6642dc9e467d32e790aad616c906cfb2827c2814e3c2f9fa80764e 23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "6BB345B76A6642DC9E467D32E790AAD616C906CFB2827C2814E3C2F9FA80764E" Last-Modified: Mon, 26 Sep 2022 04:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=5740 Expires: Tue, 27 Sep 2022 05:35:57 GMT Date: Tue, 27 Sep 2022 04:00:17 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 28621e26836a4b332c7c4f733bafa8a7 Sha1: c98feb08517cf6518d0c9f49a345bd21945ae17d Sha256: 6bb345b76a6642dc9e467d32e790aad616c906cfb2827c2814e3c2f9fa80764e
GET /r.php?p=c:xecd97ullhqs49nas&d=62a055db84c90235f05e05a1&s=48 HTTP/1.1 Host: cola.labtrffc.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site	URL: cola.labtrffc.com/r.php?p=c:xecd97ullhqs49nas&d=62a055d (...) FQDN: cola.labtrffc.com IP: 51.83.143.92 HASH: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 51.83.143.92 HTTP/1.1 302 Found Content-Type: text/html; charset=UTF-8 Server: nginx Date: Tue, 27 Sep 2022 04:00:17 GMT Content-Length: 0 Connection: keep-alive Round: 12cca187zq Raund: 2fk Location: http://pollo.trffcsource.com/l.php?p=c:ta9_53qhga_krzx5f&d=62fb8110fa240e28771bb35b&s=48&pid=63327551c665ec7be64c856f --- Additional Info --- Magic: Size: 0 Md5: d41d8cd98f00b204e9800998ecf8427e Sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /l.php?p=c:ta9_53qhga_krzx5f&d=62fb8110fa240e28771bb35b&s=48&pid=63327551c665ec7be64c856f HTTP/1.1 Host: pollo.trffcsource.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Upgrade-Insecure-Requests: 1	URL: pollo.trffcsource.com/l.php?p=c:ta9_53qhga_krzx5f&d=62f (...) FQDN: pollo.trffcsource.com IP: 51.83.143.92 HASH: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 51.83.143.92 HTTP/1.1 302 Found Content-Type: text/html; charset=UTF-8 Server: nginx Date: Tue, 27 Sep 2022 04:00:17 GMT Content-Length: 0 Connection: keep-alive Round: 11yr45wnwa Raund: 10uu72ypsp-10vor7qos4-1qr Location: https://8.us.findthewnd.xyz/feed/?link=true&tid=8&subid=8.no&ref=&s1=633275517c4e7a33545f486d --- Additional Info --- Magic: Size: 0 Md5: d41d8cd98f00b204e9800998ecf8427e Sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.77.32 HASH: 35b6c64d6d14696eb4a8d1863cfc8151a4d84c09fa68448febb5d1ab49b95e74 23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "35B6C64D6D14696EB4A8D1863CFC8151A4D84C09FA68448FEBB5D1AB49B95E74" Last-Modified: Mon, 26 Sep 2022 04:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=18068 Expires: Tue, 27 Sep 2022 09:01:26 GMT Date: Tue, 27 Sep 2022 04:00:18 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: e77a0fdd1b3c5aa1933b65ab5b8e6392 Sha1: 2d5c2f94e08026f7f6759964d866c36f5dec5707 Sha256: 35b6c64d6d14696eb4a8d1863cfc8151a4d84c09fa68448febb5d1ab49b95e74
GET /feed/?link=true&tid=8&subid=8.no&ref=&s1=633275517c4e7a33545f486d HTTP/1.1 Host: 8.us.findthewnd.xyz User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site	URL: 8.us.findthewnd.xyz/feed/?link=true&tid=8&subid=8.no&re (...) FQDN: 8.us.findthewnd.xyz IP: 23.235.251.114 HASH: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 23.235.251.114 HTTP/1.1 301 Moved Permanently Cache-Control: no-cache Location: https://redir.findthewind.xyz/click/invalid/?tid=8&subid=8.no Date: Tue, 27 Sep 2022 04:00:19 GMT Connection: keep-alive Keep-Alive: timeout=5 Transfer-Encoding: chunked --- Additional Info --- Magic: Size: 0 Md5: d41d8cd98f00b204e9800998ecf8427e Sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /?utm_medium=ec4eee60be986151ad56a07d62a9c3fe7802b9db&utm_campaign=mainstream2021&1=1&cid=0b5d3df1-ff7c-4d7c-bf13-c29134ec1ce2 HTTP/1.1 Host: go.monetizer.mobi User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Cookie: u=17efd21951c8f38faa309233e309fc3a Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: none Sec-Fetch-User: ?1	URL: go.monetizer.mobi/?utm_medium=ec4eee60be986151ad56a07d6 (...) FQDN: go.monetizer.mobi IP: 198.143.165.221 198.143.165.221 HTTP/2 200 OK content-type: text/html; charset=UTF-8 server: nginx date: Tue, 27 Sep 2022 04:00:12 GMT location: https://go.monetizer.mobi/?utm_term=7147904527885140061&ver=4viyaptcjo vary: Accept-Encoding x-powered-by: PHP/8.1.9 cache-control: no-store, no-cache, must-revalidate, max-age=0 pragma: no-cache expires: Thu, 01 Jan 1970 00:00:00 GMT strict-transport-security: max-age=31536000; includeSubdomains; content-encoding: gzip X-Firefox-Spdy: h2 --- Additional Info ---
GET /?utm_term=7147904527885140061&ver=4viyaptcjo&utm_content=e6c2c6dcd68fd49594fc9695a6a79597828bb8888e8f8ebdb2c6b0c4b6b78587b2bb88b0bdb68cbd82b280b3b6b6bcb4aaaba9a9aeafacada293a1919697f8f4848f9b8a8f9f89c09291898c87959de5cbfbf8cbcaffcec9f2f3f085848291f5cafac8f8fcf7fccdf3f3f2f5c6c7c4c5dae8edebe8ebebebebebe6e2e0efece61b84 HTTP/1.1 Host: go.monetizer.mobi User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://go.monetizer.mobi/?utm_medium=ec4eee60be986151ad56a07d62a9c3fe7802b9db&utm_campaign=mainstream2021&1=1&cid=0b5d3df1-ff7c-4d7c-bf13-c29134ec1ce2 Cookie: u=17efd21951c8f38faa309233e309fc3a Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-origin TE: trailers	URL: go.monetizer.mobi/?utm_term=7147904527885140061&ver=4vi (...) FQDN: go.monetizer.mobi IP: 198.143.165.221 198.143.165.221 HTTP/2 200 OK content-type: text/html; charset=utf-8 server: nginx date: Tue, 27 Sep 2022 04:00:12 GMT vary: Accept-Encoding x-powered-by: PHP/8.1.9 cache-control: no-store, no-cache, must-revalidate, max-age=0 pragma: no-cache expires: Thu, 01 Jan 1970 00:00:00 GMT strict-transport-security: max-age=31536000; includeSubdomains; content-encoding: gzip X-Firefox-Spdy: h2 --- Additional Info ---

                                        
                                            POST / HTTP/1.1 

                                        
                                            
Host: r3.o.lencr.org

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Content-Type: application/ocsp-request 

                                        
                                            
Content-Length: 85 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache

                                         23.36.77.32

                                        
                                            HTTP/1.1 200 OK 

                                        
                                            
Content-Type: application/ocsp-response

                                        

                                        
                                            
Server: nginx 

                                        
                                            
Content-Length: 503 

                                        
                                            
ETag: "4397E6B45B5822FBAB9B83ABE0B96EE70EFBA7CD2160B51936159865EDE5FDB1" 

                                        
                                            
Last-Modified: Sun, 25 Sep 2022 18:00:00 UTC 

                                        
                                            
Cache-Control: public, no-transform, must-revalidate, max-age=19966 

                                        
                                            
Expires: Tue, 27 Sep 2022 09:32:56 GMT 

                                        
                                            
Date: Tue, 27 Sep 2022 04:00:10 GMT 

                                        
                                            
Connection: keep-alive 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  data

                                                Size:   503

                                                Md5:    d2560f62890e75b8de444fed96c22f52

                                                Sha1:   334ce0c48e606ee029f31eeb1463af87b1024bb9

                                                Sha256: 4397e6b45b5822fbab9b83abe0b96ee70efba7cd2160b51936159865ede5fdb1

                                        
                                            GET /chains/remote-settings.content-signature.mozilla.org-2022-10-30-18-47-44.chain HTTP/1.1 

                                        
                                            
Host: content-signature-2.cdn.mozilla.net

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: empty 

                                        
                                            
Sec-Fetch-Mode: no-cors 

                                        
                                            
Sec-Fetch-Site: cross-site

                                         143.204.55.25

                                        
                                            HTTP/2 200 OK 

                                        
                                            
content-type: binary/octet-stream

                                        

                                        
                                            
content-length: 5348 

                                        
                                            
last-modified: Sat, 10 Sep 2022 18:47:45 GMT 

                                        
                                            
content-disposition: attachment 

                                        
                                            
accept-ranges: bytes 

                                        
                                            
server: AmazonS3 

                                        
                                            
date: Mon, 26 Sep 2022 04:35:16 GMT 

                                        
                                            
etag: "6113f8408c59aebe188d6af273b90743" 

                                        
                                            
x-cache: Hit from cloudfront 

                                        
                                            
via: 1.1 a034aae43a19aef875fa395182990970.cloudfront.net (CloudFront) 

                                        
                                            
x-amz-cf-pop: OSL50-C1 

                                        
                                            
x-amz-cf-id: KySloWSbk2usboeceRkPGQKw73v_AGzaOJCTKx9zMh8VMK7JephpLg== 

                                        
                                            
age: 84295 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  PEM certificate\012- , ASCII text

                                                Size:   5348

                                                Md5:    6113f8408c59aebe188d6af273b90743

                                                Sha1:   7398873bf00f99944eaa77ad3ebc0d43c23dba6b

                                                Sha256: b6e0cc9ad68306208a160f3835fb8da76acc5a82d8fde1da5a98e1de1c11a770

                                        
                                            GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 

                                        
                                            
Host: firefox.settings.services.mozilla.com

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 

                                        
                                            
Accept: application/json 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Content-Type: application/json 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: empty 

                                        
                                            
Sec-Fetch-Mode: cors 

                                        
                                            
Sec-Fetch-Site: cross-site

                                         143.204.55.35

                                        
                                            HTTP/1.1 200 OK 

                                        
                                            
Content-Type: application/json

                                        

                                        
                                            
Content-Length: 329 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Access-Control-Allow-Origin: * 

                                        
                                            
Access-Control-Expose-Headers: ETag, Expires, Content-Length, Cache-Control, Pragma, Content-Type, Alert, Backoff, Last-Modified, Retry-After 

                                        
                                            
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none'; 

                                        
                                            
Last-Modified: Fri, 25 Mar 2022 17:45:46 GMT 

                                        
                                            
Strict-Transport-Security: max-age=31536000 

                                        
                                            
X-Content-Type-Options: nosniff 

                                        
                                            
Date: Tue, 27 Sep 2022 03:10:46 GMT 

                                        
                                            
Cache-Control: max-age=3600, max-age=3600 

                                        
                                            
Expires: Tue, 27 Sep 2022 03:36:19 GMT 

                                        
                                            
ETag: "1648230346554" 

                                        
                                            
X-Cache: Hit from cloudfront 

                                        
                                            
Via: 1.1 96c778ce6156d12f24b8b6cdaa0cbf66.cloudfront.net (CloudFront) 

                                        
                                            
X-Amz-Cf-Pop: OSL50-C1 

                                        
                                            
X-Amz-Cf-Id: OuapsLjFAqFKaFFTYJtssbQxPdjwtBFkkO_IZsHU5pe7lxLnH5uqBw== 

                                        
                                            
Age: 2965 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  JSON data\012- , ASCII text, with very long lines (329), with no line terminators

                                                Size:   329

                                                Md5:    0333b0655111aa68de771adfcc4db243

                                                Sha1:   63f295a144ac87a7c8e23417626724eeca68a7eb

                                                Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

                                        
                                            POST / HTTP/1.1 

                                        
                                            
Host: ocsp.sca1b.amazontrust.com

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Content-Type: application/ocsp-request 

                                        
                                            
Content-Length: 83 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache

                                         143.204.42.158

                                        
                                            HTTP/1.1 200 OK 

                                        
                                            
Content-Type: application/ocsp-response

                                        

                                        
                                            
Content-Length: 471 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Cache-Control: 'max-age=158059' 

                                        
                                            
Date: Tue, 27 Sep 2022 04:00:11 GMT 

                                        
                                            
Server: ECS (dcb/7F5E) 

                                        
                                            
X-Cache: Miss from cloudfront 

                                        
                                            
Via: 1.1 4f01f770085624552bc30a98954f963a.cloudfront.net (CloudFront) 

                                        
                                            
X-Amz-Cf-Pop: OSL50-C1 

                                        
                                            
X-Amz-Cf-Id: 8BEMJf4aNWoMpJ06bqMPk6yOeohu0YVHddRc-EEokfThHcokjKmMQg== 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  data

                                                Size:   471

                                                Md5:    53a9e2273b299b9f4b72749b85699599

                                                Sha1:   5e55ec2164eb8fea16d96731c6a4cc93e8094ad2

                                                Sha256: 4465f1d030be739d1f111b6c3811c2925997dd20e330c7e41abe3d69f1c4226a

                                        
                                            POST / HTTP/1.1 

                                        
                                            
Host: r3.o.lencr.org

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Content-Type: application/ocsp-request 

                                        
                                            
Content-Length: 85 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache

                                         23.36.77.32

                                        
                                            HTTP/1.1 200 OK 

                                        
                                            
Content-Type: application/ocsp-response

                                        

                                        
                                            
Server: nginx 

                                        
                                            
Content-Length: 503 

                                        
                                            
ETag: "519E9B47DDFA1E1FE047F4DC7DF88E3011817F88144FCC3853A7984A781C2070" 

                                        
                                            
Last-Modified: Sun, 25 Sep 2022 22:00:00 UTC 

                                        
                                            
Cache-Control: public, no-transform, must-revalidate, max-age=3368 

                                        
                                            
Expires: Tue, 27 Sep 2022 04:56:21 GMT 

                                        
                                            
Date: Tue, 27 Sep 2022 04:00:13 GMT 

                                        
                                            
Connection: keep-alive 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  data

                                                Size:   503

                                                Md5:    5a6097201b7da81f6e9a6d99a7353a0c

                                                Sha1:   d4240fe80c76013b9f7b6fd09963aa47151b8d6a

                                                Sha256: 519e9b47ddfa1e1fe047f4dc7df88e3011817f88144fcc3853a7984a781c2070

                                        
                                            POST / HTTP/1.1 

                                        
                                            
Host: r3.o.lencr.org

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Content-Type: application/ocsp-request 

                                        
                                            
Content-Length: 85 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache

                                         23.36.77.32

                                        
                                            HTTP/1.1 200 OK 

                                        
                                            
Content-Type: application/ocsp-response

                                        

                                        
                                            
Server: nginx 

                                        
                                            
Content-Length: 503 

                                        
                                            
ETag: "519E9B47DDFA1E1FE047F4DC7DF88E3011817F88144FCC3853A7984A781C2070" 

                                        
                                            
Last-Modified: Sun, 25 Sep 2022 22:00:00 UTC 

                                        
                                            
Cache-Control: public, no-transform, must-revalidate, max-age=3368 

                                        
                                            
Expires: Tue, 27 Sep 2022 04:56:21 GMT 

                                        
                                            
Date: Tue, 27 Sep 2022 04:00:13 GMT 

                                        
                                            
Connection: keep-alive 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  data

                                                Size:   503

                                                Md5:    5a6097201b7da81f6e9a6d99a7353a0c

                                                Sha1:   d4240fe80c76013b9f7b6fd09963aa47151b8d6a

                                                Sha256: 519e9b47ddfa1e1fe047f4dc7df88e3011817f88144fcc3853a7984a781c2070

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F14ab4d12-a7de-4708-a657-df4600198640.jpeg HTTP/1.1 

                                        
                                            
Host: img-getpocket.cdn.mozilla.net

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 

                                        
                                            
Accept: image/avif,image/webp,*/* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Origin: null 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: image 

                                        
                                            
Sec-Fetch-Mode: cors 

                                        
                                            
Sec-Fetch-Site: cross-site

                                         34.120.237.76

                                        
                                            HTTP/2 200 OK 

                                        
                                            
content-type: image/jpeg

                                        

                                        
                                            
server: nginx 

                                        
                                            
content-length: 8255 

                                        
                                            
x-amzn-requestid: 3bf29c4a-406a-4645-ad18-44cd6f05d457 

                                        
                                            
x-xss-protection: 1; mode=block 

                                        
                                            
access-control-allow-origin: * 

                                        
                                            
strict-transport-security: max-age=63072000; includeSubdomains; preload 

                                        
                                            
x-frame-options: DENY 

                                        
                                            
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' 

                                        
                                            
x-amz-apigw-id: Y4VnFEV-IAMFQMQ= 

                                        
                                            
x-content-type-options: nosniff 

                                        
                                            
x-amzn-trace-id: Root=1-632ccfc6-3eaa337d1e1c1b6d5e951419;Sampled=0 

                                        
                                            
x-amzn-remapped-date: Thu, 22 Sep 2022 21:12:38 GMT 

                                        
                                            
x-amz-cf-pop: SEA73-P1 

                                        
                                            
x-cache: Hit from cloudfront 

                                        
                                            
x-amz-cf-id: X-6P09-hgjmDFe4Y7P1KnXtJAuvJNen8XsBVIexf521SOxMivJ4t7A== 

                                        
                                            
via: 1.1 2afae0d44e2540f472c0635ab62c232a.cloudfront.net (CloudFront), 1.1 989017835f43d594873bde5a7ee7fe5e.cloudfront.net (CloudFront), 1.1 google 

                                        
                                            
date: Mon, 26 Sep 2022 17:53:33 GMT 

                                        
                                            
age: 36400 

                                        
                                            
etag: "04a0665f771562c3e56ac3542abe5bd3c4c1a6b5" 

                                        
                                            
cache-control: max-age=3600,public,public 

                                        
                                            
alt-svc: clear 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

                                                Size:   8255

                                                Md5:    fa70ece15044b7318cb11ae5e37a64e7

                                                Sha1:   04a0665f771562c3e56ac3542abe5bd3c4c1a6b5

                                                Sha256: 8c974283b2ba0058114404af3e4818daa8cc56f270cb8a46f5f2f54de9d2f0e1

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5bf02f4e-91c0-455b-8378-5eae82174db7.jpeg HTTP/1.1 

                                        
                                            
Host: img-getpocket.cdn.mozilla.net

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 

                                        
                                            
Accept: image/avif,image/webp,*/* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Origin: null 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: image 

                                        
                                            
Sec-Fetch-Mode: cors 

                                        
                                            
Sec-Fetch-Site: cross-site

                                         34.120.237.76

                                        
                                            HTTP/2 200 OK 

                                        
                                            
content-type: image/jpeg

                                        

                                        
                                            
server: nginx 

                                        
                                            
content-length: 9737 

                                        
                                            
x-amzn-requestid: a06488e4-22bb-4149-adac-b6696ab91923 

                                        
                                            
x-xss-protection: 1; mode=block 

                                        
                                            
access-control-allow-origin: * 

                                        
                                            
strict-transport-security: max-age=63072000; includeSubdomains; preload 

                                        
                                            
x-frame-options: DENY 

                                        
                                            
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' 

                                        
                                            
x-amz-apigw-id: ZFlATHzUIAMFtcw= 

                                        
                                            
x-content-type-options: nosniff 

                                        
                                            
x-amzn-trace-id: Root=1-63321b9b-238f1b945a8b549872c85f2a;Sampled=0 

                                        
                                            
x-amzn-remapped-date: Mon, 26 Sep 2022 21:37:31 GMT 

                                        
                                            
x-amz-cf-pop: HIO50-C1, SEA73-P1 

                                        
                                            
x-cache: Miss from cloudfront 

                                        
                                            
x-amz-cf-id: qkfz02g1BMeZhFonJAWyqyQ9jBnZC4i-2ZHzO2wgJBVjC4YfvtlxCA== 

                                        
                                            
via: 1.1 000f4a2f631bace380a0afa747a82482.cloudfront.net (CloudFront), 1.1 e80693c02cfdfd081110512210d57840.cloudfront.net (CloudFront), 1.1 google 

                                        
                                            
date: Mon, 26 Sep 2022 21:38:57 GMT 

                                        
                                            
age: 22876 

                                        
                                            
etag: "932c74fa24b61ee1b1c672b6c19b1e736caab8d3" 

                                        
                                            
cache-control: max-age=3600,public,public 

                                        
                                            
alt-svc: clear 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

                                                Size:   9737

                                                Md5:    3140ec95f33c36599de95b25cdade940

                                                Sha1:   932c74fa24b61ee1b1c672b6c19b1e736caab8d3

                                                Sha256: f7488246ca75fddc504812f4c5944a5a2494cdb14b6ef1db5fb28beca5cff194

                                        
                                            POST / HTTP/1.1 

                                        
                                            
Host: r3.o.lencr.org

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Content-Type: application/ocsp-request 

                                        
                                            
Content-Length: 85 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache

                                         23.36.77.32

                                        
                                            HTTP/1.1 200 OK 

                                        
                                            
Content-Type: application/ocsp-response

                                        

                                        
                                            
Server: nginx 

                                        
                                            
Content-Length: 503 

                                        
                                            
ETag: "519E9B47DDFA1E1FE047F4DC7DF88E3011817F88144FCC3853A7984A781C2070" 

                                        
                                            
Last-Modified: Sun, 25 Sep 2022 22:00:00 UTC 

                                        
                                            
Cache-Control: public, no-transform, must-revalidate, max-age=3368 

                                        
                                            
Expires: Tue, 27 Sep 2022 04:56:21 GMT 

                                        
                                            
Date: Tue, 27 Sep 2022 04:00:13 GMT 

                                        
                                            
Connection: keep-alive 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  data

                                                Size:   503

                                                Md5:    5a6097201b7da81f6e9a6d99a7353a0c

                                                Sha1:   d4240fe80c76013b9f7b6fd09963aa47151b8d6a

                                                Sha256: 519e9b47ddfa1e1fe047f4dc7df88e3011817f88144fcc3853a7984a781c2070

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe29cee89-5693-407a-b182-e52f8fe5734f.jpeg HTTP/1.1 

                                        
                                            
Host: img-getpocket.cdn.mozilla.net

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 

                                        
                                            
Accept: image/avif,image/webp,*/* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Origin: null 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: image 

                                        
                                            
Sec-Fetch-Mode: cors 

                                        
                                            
Sec-Fetch-Site: cross-site

                                         34.120.237.76

                                        
                                            HTTP/2 200 OK 

                                        
                                            
content-type: image/jpeg

                                        

                                        
                                            
server: nginx 

                                        
                                            
content-length: 11885 

                                        
                                            
x-amzn-requestid: a8f6d57a-8bd3-42b9-80ba-695c5baac04b 

                                        
                                            
x-xss-protection: 1; mode=block 

                                        
                                            
access-control-allow-origin: * 

                                        
                                            
strict-transport-security: max-age=63072000; includeSubdomains; preload 

                                        
                                            
x-frame-options: DENY 

                                        
                                            
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' 

                                        
                                            
x-amz-apigw-id: YshLpHZPIAMFZiQ= 

                                        
                                            
x-content-type-options: nosniff 

                                        
                                            
x-amzn-trace-id: Root=1-6328157d-4ef5eb306dde741502e46f24;Sampled=0 

                                        
                                            
x-amzn-remapped-date: Mon, 19 Sep 2022 07:08:45 GMT 

                                        
                                            
x-amz-cf-pop: SEA19-C2 

                                        
                                            
x-cache: Hit from cloudfront 

                                        
                                            
x-amz-cf-id: JSWNUGbYq_zNf2L2AwkLuPfnGUTsX6iqCB5ESRr3dX-0voDgtu4KnQ== 

                                        
                                            
via: 1.1 0c96ded7ff282d2dbcf47c918b6bb500.cloudfront.net (CloudFront), 1.1 d8792dbd3191bbe722eba5b536b979c8.cloudfront.net (CloudFront), 1.1 google 

                                        
                                            
date: Mon, 26 Sep 2022 21:56:23 GMT 

                                        
                                            
age: 21830 

                                        
                                            
etag: "03edfe254fa4f5c88bf9c8868edd9cdf07bf5d0d" 

                                        
                                            
cache-control: max-age=3600,public,public 

                                        
                                            
alt-svc: clear 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

                                                Size:   11885

                                                Md5:    1f0a1508f459d7774c0d63ff682532c0

                                                Sha1:   03edfe254fa4f5c88bf9c8868edd9cdf07bf5d0d

                                                Sha256: eebf3b550e7a675a2231e97575e8be57e8d1216126a711cdef73ccbc5dd1e773

                                        
                                            GET /sw.js?v=1664251211093 HTTP/1.1 

                                        
                                            
Host: go.monetizer.mobi

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Service-Worker: script 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Cookie: u=17efd21951c8f38faa309233e309fc3a 

                                        
                                            
Sec-Fetch-Dest: serviceworker 

                                        
                                            
Sec-Fetch-Mode: same-origin 

                                        
                                            
Sec-Fetch-Site: same-origin 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache 

                                        
                                            
TE: trailers

                                         198.143.165.221

                                        
                                            HTTP/2 200 OK 

                                        
                                            
content-type: application/javascript

                                        

                                        
                                            
server: nginx 

                                        
                                            
date: Tue, 27 Sep 2022 04:00:13 GMT 

                                        
                                            
content-length: 775 

                                        
                                            
last-modified: Fri, 23 Sep 2022 11:12:42 GMT 

                                        
                                            
vary: Accept-Encoding 

                                        
                                            
etag: "632d94aa-307" 

                                        
                                            
content-encoding: gzip 

                                        
                                            
content-security-policy: default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; style-src * 'unsafe-inline'; 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  ASCII text

                                                Size:   775

                                                Md5:    de06f24ba6d6b0c514015a9847dace54

                                                Sha1:   c9662e4339d4f72af3526b21d4d6d68df21b0ba9

                                                Sha256: 70d55f6e4bab19ae4b3cc61642e88a78a599b060c72d10c15c5f937e34305ee9

                                        
                                            GET /proc.php?7aa6b76bb7b1da2c08e2a6b2bb8679cb3b55ffa0 HTTP/1.1 

                                        
                                            
Host: go.monetizer.mobi

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 

                                        
                                            
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Referer: https://go.monetizer.mobi/?utm_term=7147904527885140061&ver=4viyaptcjo&utm_content=e6c2c6dcd68fd49594fc9695a6a79597828bb8888e8f8ebdb2c6b0c4b6b78587b2bb88b0bdb68cbd82b280b3b6b6bcb4aaaba9a9aeafacada293a1919697f8f4848f9b8a8f9f89c09291898c87959de5cbfbf8cbcaffcec9f2f3f085848291f5cafac8f8fcf7fccdf3f3f2f5c6c7c4c5dae8edebe8ebebebebebe6e2e0efece61b84 

                                        
                                            
Cookie: u=17efd21951c8f38faa309233e309fc3a 

                                        
                                            
Upgrade-Insecure-Requests: 1 

                                        
                                            
Sec-Fetch-Dest: document 

                                        
                                            
Sec-Fetch-Mode: navigate 

                                        
                                            
Sec-Fetch-Site: same-origin 

                                        
                                            
TE: trailers

                                         198.143.165.221

                                        
                                            HTTP/2 200 OK 

                                        
                                            
content-type: text/html; charset=UTF-8

                                        

                                        
                                            
server: nginx 

                                        
                                            
date: Tue, 27 Sep 2022 04:00:13 GMT 

                                        
                                            
location: https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7147904527885140061&website=797-403c551a&placement=797 

                                        
                                            
vary: Accept-Encoding 

                                        
                                            
x-powered-by: PHP/8.1.9 

                                        
                                            
cache-control: no-store, no-cache, must-revalidate, max-age=0 

                                        
                                            
pragma: no-cache 

                                        
                                            
expires: Thu, 01 Jan 1970 00:00:00 GMT 

                                        
                                            
strict-transport-security: max-age=31536000; includeSubdomains; 

                                        
                                            
content-encoding: gzip 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (3576), with no line terminators

                                                Size:   1547

                                                Md5:    e8a161691d32b04983d78a4c6e12e2c7

                                                Sha1:   5a9e72ad05ec548943406810555e5a78fdfd7e58

                                                Sha256: 71d28f8108b8a08eaf246fffd8268fe2fa5acd82dc9118ac430bea14dc484393

                                        
                                            GET /favicon.ico HTTP/1.1 

                                        
                                            
Host: www.wewillserv.com

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 

                                        
                                            
Accept: image/avif,image/webp,*/* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: image 

                                        
                                            
Sec-Fetch-Mode: no-cors 

                                        
                                            
Sec-Fetch-Site: same-origin

                                         51.68.81.31

                                        
                                            HTTP/1.1 204 No Content

                                        

                                        
                                            
Server: openresty 

                                        
                                            
Date: Tue, 27 Sep 2022 04:00:13 GMT 

                                        
                                            
Connection: keep-alive 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  

                                                Size:   0

                                                Md5:    d41d8cd98f00b204e9800998ecf8427e

                                                Sha1:   da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                        
                                            GET /sl?id=5f0efd61dabed1d602e0fe6a&pid=503&sub1=33000c5a0391e8ccfbbcca9e9f7408d9202e70927-202209-flb*5467509-4538f*M7147904527885140061*sl_5467509-4538f*dccb0a3cb6b4a731440efcb68deaa526e1f89153*797-403c551a*797 HTTP/1.1 

                                        
                                            
Host: admoustache.go2affise.com

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 

                                        
                                            
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Upgrade-Insecure-Requests: 1 

                                        
                                            
Sec-Fetch-Dest: document 

                                        
                                            
Sec-Fetch-Mode: navigate 

                                        
                                            
Sec-Fetch-Site: cross-site

                                         34.90.46.36

                                        
                                            HTTP/2 302 Found

                                        

                                        
                                            
server: nginx 

                                        
                                            
date: Tue, 27 Sep 2022 04:00:14 GMT 

                                        
                                            
content-length: 0 

                                        
                                            
location: https://t2.blowingwnd.com/l.php?p=c:o6450ylcdnn31butk&d=624e9ea3e8e2a8163b65d246&pid=6332754ea00dbc00017e8901&s=503 

                                        
                                            
set-cookie: afclick=6332754ea00dbc00017e8901; expires=Wed, 27 Sep 2023 04:00:14 GMT; secure; SameSite=None 

                                        
                                            
access-control-allow-origin: * 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  

                                                Size:   0

                                                Md5:    d41d8cd98f00b204e9800998ecf8427e

                                                Sha1:   da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                        
                                            GET /l.php?p=c:o6450ylcdnn31butk&d=624e9ea3e8e2a8163b65d246&pid=6332754ea00dbc00017e8901&s=503 HTTP/1.1 

                                        
                                            
Host: t2.blowingwnd.com

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 

                                        
                                            
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Upgrade-Insecure-Requests: 1 

                                        
                                            
Sec-Fetch-Dest: document 

                                        
                                            
Sec-Fetch-Mode: navigate 

                                        
                                            
Sec-Fetch-Site: cross-site

                                         51.161.115.163

                                        
                                            HTTP/1.1 302 Found 

                                        
                                            
Content-Type: text/html; charset=UTF-8

                                        

                                        
                                            
Server: nginx 

                                        
                                            
Date: Tue, 27 Sep 2022 04:00:15 GMT 

                                        
                                            
Content-Length: 0 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Round: 12bbr5cth7 

                                        
                                            
Raund: 19q 

                                        
                                            
Location: https://48.us.findthewind.xyz/feed/?link=true&tid=48&subid=48.503&ref=&s1=6332754f8f89a04a095b73bb 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  

                                                Size:   0

                                                Md5:    d41d8cd98f00b204e9800998ecf8427e

                                                Sha1:   da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                        
                                            POST / HTTP/1.1 

                                        
                                            
Host: ocsp.godaddy.com

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Content-Type: application/ocsp-request 

                                        
                                            
Content-Length: 75 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache

                                         192.124.249.22

                                        
                                            HTTP/1.1 200 OK 

                                        
                                            
Content-Type: application/ocsp-response

                                        

                                        
                                            
Server: Sucuri/Cloudproxy 

                                        
                                            
Date: Tue, 27 Sep 2022 04:00:15 GMT 

                                        
                                            
Content-Length: 1777 

                                        
                                            
Connection: keep-alive 

                                        
                                            
X-Sucuri-ID: 19022 

                                        
                                            
Content-Transfer-Encoding: Binary 

                                        
                                            
Cache-Control: public, no-transform, must-revalidate 

                                        
                                            
Last-Modified: Mon, 26 Sep 2022 23:43:15 GMT 

                                        
                                            
Expires: Tue, 27 Sep 2022 23:43:15 GMT 

                                        
                                            
ETag: "49b873c2bff6f2eba87397c2ba244b04b3c317eb" 

                                        
                                            
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA" 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  data

                                                Size:   1777

                                                Md5:    98917b3482df1fb9b63778a65d8de247

                                                Sha1:   49b873c2bff6f2eba87397c2ba244b04b3c317eb

                                                Sha256: 0d8438abd1a634d426bf658f2a5f383cfdbab8b6b12a37885895166d8328c7da

                                        
                                            POST / HTTP/1.1 

                                        
                                            
Host: r3.o.lencr.org

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Content-Type: application/ocsp-request 

                                        
                                            
Content-Length: 85 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache

                                         23.36.77.32

                                        
                                            HTTP/1.1 200 OK 

                                        
                                            
Content-Type: application/ocsp-response

                                        

                                        
                                            
Server: nginx 

                                        
                                            
Content-Length: 503 

                                        
                                            
ETag: "9845E12580CBFC6263681AE1307766DD0955B0698F4BA0A0A18527E9595D1D93" 

                                        
                                            
Last-Modified: Mon, 26 Sep 2022 04:00:00 UTC 

                                        
                                            
Cache-Control: public, no-transform, must-revalidate, max-age=18109 

                                        
                                            
Expires: Tue, 27 Sep 2022 09:02:06 GMT 

                                        
                                            
Date: Tue, 27 Sep 2022 04:00:17 GMT 

                                        
                                            
Connection: keep-alive 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  data

                                                Size:   503

                                                Md5:    747e5d0b7cb7686662a71efa89dc4bdd

                                                Sha1:   4d9630aadfb716491bd35632f8cd8ebf1b5af55c

                                                Sha256: 9845e12580cbfc6263681ae1307766dd0955b0698f4ba0a0a18527e9595d1d93

                                        
                                            POST / HTTP/1.1 

                                        
                                            
Host: r3.o.lencr.org

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Content-Type: application/ocsp-request 

                                        
                                            
Content-Length: 85 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache

                                         23.36.77.32

                                        
                                            HTTP/1.1 200 OK 

                                        
                                            
Content-Type: application/ocsp-response

                                        

                                        
                                            
Server: nginx 

                                        
                                            
Content-Length: 503 

                                        
                                            
ETag: "6BB345B76A6642DC9E467D32E790AAD616C906CFB2827C2814E3C2F9FA80764E" 

                                        
                                            
Last-Modified: Mon, 26 Sep 2022 04:00:00 UTC 

                                        
                                            
Cache-Control: public, no-transform, must-revalidate, max-age=5740 

                                        
                                            
Expires: Tue, 27 Sep 2022 05:35:57 GMT 

                                        
                                            
Date: Tue, 27 Sep 2022 04:00:17 GMT 

                                        
                                            
Connection: keep-alive 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  data

                                                Size:   503

                                                Md5:    28621e26836a4b332c7c4f733bafa8a7

                                                Sha1:   c98feb08517cf6518d0c9f49a345bd21945ae17d

                                                Sha256: 6bb345b76a6642dc9e467d32e790aad616c906cfb2827c2814e3c2f9fa80764e

                                        
                                            GET /l.php?p=c:ta9_53qhga_krzx5f&d=62fb8110fa240e28771bb35b&s=48&pid=63327551c665ec7be64c856f HTTP/1.1 

                                        
                                            
Host: pollo.trffcsource.com

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 

                                        
                                            
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Upgrade-Insecure-Requests: 1

                                         51.83.143.92

                                        
                                            HTTP/1.1 302 Found 

                                        
                                            
Content-Type: text/html; charset=UTF-8

                                        

                                        
                                            
Server: nginx 

                                        
                                            
Date: Tue, 27 Sep 2022 04:00:17 GMT 

                                        
                                            
Content-Length: 0 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Round: 11yr45wnwa 

                                        
                                            
Raund: 10uu72ypsp-10vor7qos4-1qr 

                                        
                                            
Location: https://8.us.findthewnd.xyz/feed/?link=true&tid=8&subid=8.no&ref=&s1=633275517c4e7a33545f486d 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  

                                                Size:   0

                                                Md5:    d41d8cd98f00b204e9800998ecf8427e

                                                Sha1:   da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                        
                                            GET /feed/?link=true&tid=8&subid=8.no&ref=&s1=633275517c4e7a33545f486d HTTP/1.1 

                                        
                                            
Host: 8.us.findthewnd.xyz

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 

                                        
                                            
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Upgrade-Insecure-Requests: 1 

                                        
                                            
Sec-Fetch-Dest: document 

                                        
                                            
Sec-Fetch-Mode: navigate 

                                        
                                            
Sec-Fetch-Site: cross-site

                                         23.235.251.114

                                        
                                            HTTP/1.1 301 Moved Permanently

                                        

                                        
                                            
Cache-Control: no-cache 

                                        
                                            
Location: https://redir.findthewind.xyz/click/invalid/?tid=8&subid=8.no 

                                        
                                            
Date: Tue, 27 Sep 2022 04:00:19 GMT 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Keep-Alive: timeout=5 

                                        
                                            
Transfer-Encoding: chunked 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  

                                                Size:   0

                                                Md5:    d41d8cd98f00b204e9800998ecf8427e

                                                Sha1:   da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                        
                                            GET /?utm_term=7147904527885140061&ver=4viyaptcjo&utm_content=e6c2c6dcd68fd49594fc9695a6a79597828bb8888e8f8ebdb2c6b0c4b6b78587b2bb88b0bdb68cbd82b280b3b6b6bcb4aaaba9a9aeafacada293a1919697f8f4848f9b8a8f9f89c09291898c87959de5cbfbf8cbcaffcec9f2f3f085848291f5cafac8f8fcf7fccdf3f3f2f5c6c7c4c5dae8edebe8ebebebebebe6e2e0efece61b84 HTTP/1.1 

                                        
                                            
Host: go.monetizer.mobi

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 

                                        
                                            
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Referer: https://go.monetizer.mobi/?utm_medium=ec4eee60be986151ad56a07d62a9c3fe7802b9db&utm_campaign=mainstream2021&1=1&cid=0b5d3df1-ff7c-4d7c-bf13-c29134ec1ce2 

                                        
                                            
Cookie: u=17efd21951c8f38faa309233e309fc3a 

                                        
                                            
Upgrade-Insecure-Requests: 1 

                                        
                                            
Sec-Fetch-Dest: document 

                                        
                                            
Sec-Fetch-Mode: navigate 

                                        
                                            
Sec-Fetch-Site: same-origin 

                                        
                                            
TE: trailers

                                         198.143.165.221

                                        
                                            HTTP/2 200 OK 

                                        
                                            
content-type: text/html; charset=utf-8

                                        

                                        
                                            
server: nginx 

                                        
                                            
date: Tue, 27 Sep 2022 04:00:12 GMT 

                                        
                                            
vary: Accept-Encoding 

                                        
                                            
x-powered-by: PHP/8.1.9 

                                        
                                            
cache-control: no-store, no-cache, must-revalidate, max-age=0 

                                        
                                            
pragma: no-cache 

                                        
                                            
expires: Thu, 01 Jan 1970 00:00:00 GMT 

                                        
                                            
strict-transport-security: max-age=31536000; includeSubdomains; 

                                        
                                            
content-encoding: gzip 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

URL	snnl-glo.ketogermany.com/t/clk
IP	52.58.131.39 (Germany)
ASN	#16509 AMAZON-02
UserAgent	Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer
Report completed	2022-09-27 04:00:22 UTC
Status	Loading report..
IDS alerts	0
Blocklist alert	1
urlquery alerts	No alerts detected
Tags	None

Request	Response
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.77.32 HASH: 4397e6b45b5822fbab9b83abe0b96ee70efba7cd2160b51936159865ede5fdb1 23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "4397E6B45B5822FBAB9B83ABE0B96EE70EFBA7CD2160B51936159865EDE5FDB1" Last-Modified: Sun, 25 Sep 2022 18:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=19966 Expires: Tue, 27 Sep 2022 09:32:56 GMT Date: Tue, 27 Sep 2022 04:00:10 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: d2560f62890e75b8de444fed96c22f52 Sha1: 334ce0c48e606ee029f31eeb1463af87b1024bb9 Sha256: 4397e6b45b5822fbab9b83abe0b96ee70efba7cd2160b51936159865ede5fdb1
GET /v1/ HTTP/1.1 Host: firefox.settings.services.mozilla.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: firefox.settings.services.mozilla.com/v1/ FQDN: firefox.settings.services.mozilla.com IP: 143.204.55.35 HASH: 73c273c0b5a2de3cb970b8e8c187999d3b55e760dc7766dab4bb76428d19b551 143.204.55.35 HTTP/1.1 200 OK Content-Type: application/json Content-Length: 939 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length, Backoff, Content-Type, Retry-After, Alert Cache-Control: max-age=3600 Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none'; Date: Tue, 27 Sep 2022 03:15:30 GMT X-Content-Type-Options: nosniff X-Cache: Hit from cloudfront Via: 1.1 aac54e3fe9825ce24d51e0204433c2c0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: OSL50-C1 X-Amz-Cf-Id: ugzwGV8zz7GyOVSWvkan5EoacsZkOFR3KJWFYn9ShXAeNQDgfueBpw== Age: 2680 --- Additional Info --- Magic: JSON data\012- , ASCII text, with very long lines (939), with no line terminators Size: 939 Md5: 2d12f67fe57a87e7366b662d153a5582 Sha1: d7b02d81cc74f24a251d9363e0f4b0a149264ec1 Sha256: 73c273c0b5a2de3cb970b8e8c187999d3b55e760dc7766dab4bb76428d19b551
GET /chains/remote-settings.content-signature.mozilla.org-2022-10-30-18-47-44.chain HTTP/1.1 Host: content-signature-2.cdn.mozilla.net User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: no-cors Sec-Fetch-Site: cross-site	URL: content-signature-2.cdn.mozilla.net/chains/remote-setti (...) FQDN: content-signature-2.cdn.mozilla.net IP: 143.204.55.25 HASH: b6e0cc9ad68306208a160f3835fb8da76acc5a82d8fde1da5a98e1de1c11a770 143.204.55.25 HTTP/2 200 OK content-type: binary/octet-stream content-length: 5348 last-modified: Sat, 10 Sep 2022 18:47:45 GMT content-disposition: attachment accept-ranges: bytes server: AmazonS3 date: Mon, 26 Sep 2022 04:35:16 GMT etag: "6113f8408c59aebe188d6af273b90743" x-cache: Hit from cloudfront via: 1.1 a034aae43a19aef875fa395182990970.cloudfront.net (CloudFront) x-amz-cf-pop: OSL50-C1 x-amz-cf-id: KySloWSbk2usboeceRkPGQKw73v_AGzaOJCTKx9zMh8VMK7JephpLg== age: 84295 X-Firefox-Spdy: h2 --- Additional Info --- Magic: PEM certificate\012- , ASCII text Size: 5348 Md5: 6113f8408c59aebe188d6af273b90743 Sha1: 7398873bf00f99944eaa77ad3ebc0d43c23dba6b Sha256: b6e0cc9ad68306208a160f3835fb8da76acc5a82d8fde1da5a98e1de1c11a770
GET /v1/tiles HTTP/1.1 Host: contile.services.mozilla.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: contile.services.mozilla.com/v1/tiles FQDN: contile.services.mozilla.com IP: 34.117.237.239 HASH: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3 34.117.237.239 HTTP/2 200 OK content-type: application/json server: nginx date: Tue, 27 Sep 2022 04:00:10 GMT content-length: 12 strict-transport-security: max-age=31536000 via: 1.1 google alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JSON data\012- , ASCII text, with no line terminators Size: 12 Md5: 23e88fb7b99543fb33315b29b1fad9d6 Sha1: a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 Host: firefox.settings.services.mozilla.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: application/json Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Type: application/json Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: firefox.settings.services.mozilla.com/v1/buckets/main/c (...) FQDN: firefox.settings.services.mozilla.com IP: 143.204.55.35 HASH: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300 143.204.55.35 HTTP/1.1 200 OK Content-Type: application/json Content-Length: 329 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Expose-Headers: ETag, Expires, Content-Length, Cache-Control, Pragma, Content-Type, Alert, Backoff, Last-Modified, Retry-After Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none'; Last-Modified: Fri, 25 Mar 2022 17:45:46 GMT Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff Date: Tue, 27 Sep 2022 03:10:46 GMT Cache-Control: max-age=3600, max-age=3600 Expires: Tue, 27 Sep 2022 03:36:19 GMT ETag: "1648230346554" X-Cache: Hit from cloudfront Via: 1.1 96c778ce6156d12f24b8b6cdaa0cbf66.cloudfront.net (CloudFront) X-Amz-Cf-Pop: OSL50-C1 X-Amz-Cf-Id: OuapsLjFAqFKaFFTYJtssbQxPdjwtBFkkO_IZsHU5pe7lxLnH5uqBw== Age: 2965 --- Additional Info --- Magic: JSON data\012- , ASCII text, with very long lines (329), with no line terminators Size: 329 Md5: 0333b0655111aa68de771adfcc4db243 Sha1: 63f295a144ac87a7c8e23417626724eeca68a7eb Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
POST / HTTP/1.1 Host: ocsp.digicert.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 83 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: ocsp.digicert.com/ FQDN: ocsp.digicert.com IP: 93.184.220.29 HASH: 5c95ba48bc342887b4f7ef697bd4def50f6f2f472f654169179e5ac44df883d9 93.184.220.29 HTTP/1.1 200 OK Content-Type: application/ocsp-response Accept-Ranges: bytes Age: 3106 Cache-Control: 'max-age=158059' Date: Tue, 27 Sep 2022 04:00:11 GMT Last-Modified: Tue, 27 Sep 2022 03:08:25 GMT Server: ECS (ska/F710) X-Cache: HIT Content-Length: 471 --- Additional Info --- Magic: data Size: 471 Md5: 5adb7eb1d103eadeeafac36e663ffdd3 Sha1: 23b784388dd634fa736cd60aed71570661e73d02 Sha256: 5c95ba48bc342887b4f7ef697bd4def50f6f2f472f654169179e5ac44df883d9
GET /t/clk HTTP/1.1 Host: snnl-glo.ketogermany.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Upgrade-Insecure-Requests: 1	URL: snnl-glo.ketogermany.com/t/clk FQDN: snnl-glo.ketogermany.com IP: 52.58.131.39 HASH: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 52.58.131.39 HTTP/1.1 302 Found Content-Type: text/html; charset=utf-8 Date: Tue, 27 Sep 2022 04:00:11 GMT Content-Length: 0 Connection: keep-alive Server: nginx/1.12.2 Location: https://so-glo.yoptv33.com/t/clk?id=DQqT5fxjrUGKRmCl&rl=Dkxpn&rcode=R09&rseq=R09,R99,R98 Vary: Cookie, Origin --- Additional Info --- Magic: Size: 0 Md5: d41d8cd98f00b204e9800998ecf8427e Sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Alerts: Blocklists: - fortinet: Malware
GET / HTTP/1.1 Host: push.services.mozilla.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Sec-WebSocket-Version: 13 Origin: wss://push.services.mozilla.com/ Sec-WebSocket-Protocol: push-notification Sec-WebSocket-Extensions: permessage-deflate Sec-WebSocket-Key: FqQgKXJW13snPaaNvoshFQ== Connection: keep-alive, Upgrade Sec-Fetch-Dest: websocket Sec-Fetch-Mode: websocket Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache Upgrade: websocket	URL: push.services.mozilla.com/ FQDN: push.services.mozilla.com IP: 35.161.6.128 HASH: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 35.161.6.128 HTTP/1.1 101 Switching Protocols Connection: Upgrade Upgrade: websocket Sec-WebSocket-Accept: OgPT6lw1T8hHaJ7nhrJlT2eXda8= --- Additional Info --- Magic: Size: 0 Md5: d41d8cd98f00b204e9800998ecf8427e Sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST / HTTP/1.1 Host: ocsp.sca1b.amazontrust.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 83 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: ocsp.sca1b.amazontrust.com/ FQDN: ocsp.sca1b.amazontrust.com IP: 143.204.42.158 HASH: 4465f1d030be739d1f111b6c3811c2925997dd20e330c7e41abe3d69f1c4226a 143.204.42.158 HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 471 Connection: keep-alive Cache-Control: 'max-age=158059' Date: Tue, 27 Sep 2022 04:00:11 GMT Server: ECS (dcb/7F5E) X-Cache: Miss from cloudfront Via: 1.1 4f01f770085624552bc30a98954f963a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: OSL50-C1 X-Amz-Cf-Id: 8BEMJf4aNWoMpJ06bqMPk6yOeohu0YVHddRc-EEokfThHcokjKmMQg== --- Additional Info --- Magic: data Size: 471 Md5: 53a9e2273b299b9f4b72749b85699599 Sha1: 5e55ec2164eb8fea16d96731c6a4cc93e8094ad2 Sha256: 4465f1d030be739d1f111b6c3811c2925997dd20e330c7e41abe3d69f1c4226a
GET /t/clk?id=DQqT5fxjrUGKRmCl&rl=Dkxpn&rcode=R09&rseq=R09,R99,R98 HTTP/1.1 Host: so-glo.yoptv33.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Cookie: uip="[\"m1rJNX2\"\054 {\"oza1p\": \"2z2QePl\"}]:1od0x6:JESxrUhz4apRU0DQzrbjbi5c8Ts"; ydt_69a756d9a2a44370a5365f82fbdfa6e5="[\"d758bcaf-a484-4b92-96ff-6aa9838e7c68\"]:1od0x6:KCDPlU55OnobBV1GE_-xqLsiCDo" Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: none Sec-Fetch-User: ?1	URL: so-glo.yoptv33.com/t/clk?id=DQqT5fxjrUGKRmCl&rl=Dkxpn&r (...) FQDN: so-glo.yoptv33.com IP: 3.64.246.59 HASH: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 3.64.246.59 HTTP/2 302 Found content-type: text/html; charset=utf-8 date: Tue, 27 Sep 2022 04:00:12 GMT content-length: 0 location: https://go.monetizer.mobi/?utm_medium=ec4eee60be986151ad56a07d62a9c3fe7802b9db&utm_campaign=mainstream2021&1=1&cid=0b5d3df1-ff7c-4d7c-bf13-c29134ec1ce2 server: nginx/1.12.2 cache-control: no-transform x-frame-options: SAMEORIGIN vary: Cookie, Origin set-cookie: uip="[\"m1rJNX2\"\054 {\"oza1p\": \"2z2QePl\"}]:1od1lU:BRtUwQWRkRTSjmCLQ2G0l8OzCCA"; expires=Thu, 27 Oct 2022 04:00:12 GMT; Max-Age=2592000; Path=/ ydt_69a756d9a2a44370a5365f82fbdfa6e5="[\"d758bcaf-a484-4b92-96ff-6aa9838e7c68\"\054 \"0b5d3df1-ff7c-4d7c-bf13-c29134ec1ce2\"]:1od1lU:fzgWtJSRH6tfOQv9MkV8iyH-FG8"; expires=Thu, 27 Oct 2022 06:00:12 GMT; Max-Age=2599200; Path=/; SameSite=None; Secure X-Firefox-Spdy: h2 --- Additional Info --- Magic: Size: 0 Md5: d41d8cd98f00b204e9800998ecf8427e Sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.77.32 HASH: 519e9b47ddfa1e1fe047f4dc7df88e3011817f88144fcc3853a7984a781c2070 23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "519E9B47DDFA1E1FE047F4DC7DF88E3011817F88144FCC3853A7984A781C2070" Last-Modified: Sun, 25 Sep 2022 22:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=3368 Expires: Tue, 27 Sep 2022 04:56:21 GMT Date: Tue, 27 Sep 2022 04:00:13 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 5a6097201b7da81f6e9a6d99a7353a0c Sha1: d4240fe80c76013b9f7b6fd09963aa47151b8d6a Sha256: 519e9b47ddfa1e1fe047f4dc7df88e3011817f88144fcc3853a7984a781c2070
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.77.32 HASH: 519e9b47ddfa1e1fe047f4dc7df88e3011817f88144fcc3853a7984a781c2070 23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "519E9B47DDFA1E1FE047F4DC7DF88E3011817F88144FCC3853A7984A781C2070" Last-Modified: Sun, 25 Sep 2022 22:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=3368 Expires: Tue, 27 Sep 2022 04:56:21 GMT Date: Tue, 27 Sep 2022 04:00:13 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 5a6097201b7da81f6e9a6d99a7353a0c Sha1: d4240fe80c76013b9f7b6fd09963aa47151b8d6a Sha256: 519e9b47ddfa1e1fe047f4dc7df88e3011817f88144fcc3853a7984a781c2070
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.77.32 HASH: 519e9b47ddfa1e1fe047f4dc7df88e3011817f88144fcc3853a7984a781c2070 23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "519E9B47DDFA1E1FE047F4DC7DF88E3011817F88144FCC3853A7984A781C2070" Last-Modified: Sun, 25 Sep 2022 22:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=3368 Expires: Tue, 27 Sep 2022 04:56:21 GMT Date: Tue, 27 Sep 2022 04:00:13 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 5a6097201b7da81f6e9a6d99a7353a0c Sha1: d4240fe80c76013b9f7b6fd09963aa47151b8d6a Sha256: 519e9b47ddfa1e1fe047f4dc7df88e3011817f88144fcc3853a7984a781c2070
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ffffd9a36-7835-4249-a213-06720f62ce54.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: img-getpocket.cdn.mozilla.net/296x148/filters:format(jp (...) FQDN: img-getpocket.cdn.mozilla.net IP: 34.120.237.76 HASH: 4382f21ee6727d4b4d21bd7d16b1821a57d9fec6c78dbf7e74bfdfbde51ec206 34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 4327 x-amzn-requestid: 59493149-3c46-42c6-96aa-92c945fb4c40 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: ZFlA1HzioAMFzxw= x-content-type-options: nosniff x-amzn-trace-id: Root=1-63321b9e-5bd13d5719a119a25650f405;Sampled=0 x-amzn-remapped-date: Mon, 26 Sep 2022 21:37:34 GMT x-amz-cf-pop: HIO50-C1, SEA73-P1 x-cache: Miss from cloudfront x-amz-cf-id: 5XQYaLxNwxhN9NCIoDYRbt8U-2Tsxcx-2SqPNr64Z4YV8Bk7Eayjfg== via: 1.1 0c96ded7ff282d2dbcf47c918b6bb500.cloudfront.net (CloudFront), 1.1 6396e88c437c096ef98930ce29f731a2.cloudfront.net (CloudFront), 1.1 google date: Mon, 26 Sep 2022 21:38:57 GMT age: 22876 etag: "a92af0438aa2b6637c0f69dabd0be00b3a43caf8" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 4327 Md5: f9bc23ab347b5f2e2ec15d69f41f0cf0 Sha1: a92af0438aa2b6637c0f69dabd0be00b3a43caf8 Sha256: 4382f21ee6727d4b4d21bd7d16b1821a57d9fec6c78dbf7e74bfdfbde51ec206
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F14ab4d12-a7de-4708-a657-df4600198640.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: img-getpocket.cdn.mozilla.net/296x148/filters:format(jp (...) FQDN: img-getpocket.cdn.mozilla.net IP: 34.120.237.76 HASH: 8c974283b2ba0058114404af3e4818daa8cc56f270cb8a46f5f2f54de9d2f0e1 34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 8255 x-amzn-requestid: 3bf29c4a-406a-4645-ad18-44cd6f05d457 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: Y4VnFEV-IAMFQMQ= x-content-type-options: nosniff x-amzn-trace-id: Root=1-632ccfc6-3eaa337d1e1c1b6d5e951419;Sampled=0 x-amzn-remapped-date: Thu, 22 Sep 2022 21:12:38 GMT x-amz-cf-pop: SEA73-P1 x-cache: Hit from cloudfront x-amz-cf-id: X-6P09-hgjmDFe4Y7P1KnXtJAuvJNen8XsBVIexf521SOxMivJ4t7A== via: 1.1 2afae0d44e2540f472c0635ab62c232a.cloudfront.net (CloudFront), 1.1 989017835f43d594873bde5a7ee7fe5e.cloudfront.net (CloudFront), 1.1 google date: Mon, 26 Sep 2022 17:53:33 GMT age: 36400 etag: "04a0665f771562c3e56ac3542abe5bd3c4c1a6b5" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 8255 Md5: fa70ece15044b7318cb11ae5e37a64e7 Sha1: 04a0665f771562c3e56ac3542abe5bd3c4c1a6b5 Sha256: 8c974283b2ba0058114404af3e4818daa8cc56f270cb8a46f5f2f54de9d2f0e1
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb5538bec-989b-434a-bf80-699456665fd7.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: img-getpocket.cdn.mozilla.net/296x148/filters:format(jp (...) FQDN: img-getpocket.cdn.mozilla.net IP: 34.120.237.76 HASH: 8a1968c18b44495571ff382a9cacfb7f98d3e1275d650e84cb310d635eae7e70 34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 6829 x-amzn-requestid: cc3229a7-7c7e-472b-b7a4-1216594c4068 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: Yshb2FwhoAMF2EA= x-content-type-options: nosniff x-amzn-trace-id: Root=1-632815e5-0964e463192712fb08a29ee7;Sampled=0 x-amzn-remapped-date: Mon, 19 Sep 2022 07:10:29 GMT x-amz-cf-pop: SEA73-P1 x-cache: Hit from cloudfront x-amz-cf-id: 38UTZEh7vpUlYc9mGIdNrIy4fgLQf4iErqzZLY5mM5fdMQwvJvoBvQ== via: 1.1 112c6b3f9aea37a6cb00b7d933e5af6e.cloudfront.net (CloudFront), 1.1 5397b304713f6301c7c94ac084b6ed08.cloudfront.net (CloudFront), 1.1 google date: Mon, 26 Sep 2022 22:12:45 GMT age: 20848 etag: "c80d9ce02eeaa7b0166a696e811d2cffde4997d0" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 6829 Md5: 62ece01d7e0036711832df5a25175b3b Sha1: c80d9ce02eeaa7b0166a696e811d2cffde4997d0 Sha256: 8a1968c18b44495571ff382a9cacfb7f98d3e1275d650e84cb310d635eae7e70
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5bf02f4e-91c0-455b-8378-5eae82174db7.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: img-getpocket.cdn.mozilla.net/296x148/filters:format(jp (...) FQDN: img-getpocket.cdn.mozilla.net IP: 34.120.237.76 HASH: f7488246ca75fddc504812f4c5944a5a2494cdb14b6ef1db5fb28beca5cff194 34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 9737 x-amzn-requestid: a06488e4-22bb-4149-adac-b6696ab91923 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: ZFlATHzUIAMFtcw= x-content-type-options: nosniff x-amzn-trace-id: Root=1-63321b9b-238f1b945a8b549872c85f2a;Sampled=0 x-amzn-remapped-date: Mon, 26 Sep 2022 21:37:31 GMT x-amz-cf-pop: HIO50-C1, SEA73-P1 x-cache: Miss from cloudfront x-amz-cf-id: qkfz02g1BMeZhFonJAWyqyQ9jBnZC4i-2ZHzO2wgJBVjC4YfvtlxCA== via: 1.1 000f4a2f631bace380a0afa747a82482.cloudfront.net (CloudFront), 1.1 e80693c02cfdfd081110512210d57840.cloudfront.net (CloudFront), 1.1 google date: Mon, 26 Sep 2022 21:38:57 GMT age: 22876 etag: "932c74fa24b61ee1b1c672b6c19b1e736caab8d3" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 9737 Md5: 3140ec95f33c36599de95b25cdade940 Sha1: 932c74fa24b61ee1b1c672b6c19b1e736caab8d3 Sha256: f7488246ca75fddc504812f4c5944a5a2494cdb14b6ef1db5fb28beca5cff194
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.77.32 HASH: 519e9b47ddfa1e1fe047f4dc7df88e3011817f88144fcc3853a7984a781c2070 23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "519E9B47DDFA1E1FE047F4DC7DF88E3011817F88144FCC3853A7984A781C2070" Last-Modified: Sun, 25 Sep 2022 22:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=3368 Expires: Tue, 27 Sep 2022 04:56:21 GMT Date: Tue, 27 Sep 2022 04:00:13 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 5a6097201b7da81f6e9a6d99a7353a0c Sha1: d4240fe80c76013b9f7b6fd09963aa47151b8d6a Sha256: 519e9b47ddfa1e1fe047f4dc7df88e3011817f88144fcc3853a7984a781c2070
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.77.32 HASH: 519e9b47ddfa1e1fe047f4dc7df88e3011817f88144fcc3853a7984a781c2070 23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "519E9B47DDFA1E1FE047F4DC7DF88E3011817F88144FCC3853A7984A781C2070" Last-Modified: Sun, 25 Sep 2022 22:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=3368 Expires: Tue, 27 Sep 2022 04:56:21 GMT Date: Tue, 27 Sep 2022 04:00:13 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 5a6097201b7da81f6e9a6d99a7353a0c Sha1: d4240fe80c76013b9f7b6fd09963aa47151b8d6a Sha256: 519e9b47ddfa1e1fe047f4dc7df88e3011817f88144fcc3853a7984a781c2070
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F79631135-a10c-43bf-85d2-fa2236b96883.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: img-getpocket.cdn.mozilla.net/296x148/filters:format(jp (...) FQDN: img-getpocket.cdn.mozilla.net IP: 34.120.237.76 HASH: 058d798963f83f5fb88ab728185f755c5353fa981d93e1b6ff869089f501586b 34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 13213 x-amzn-requestid: fe9ec409-2757-4910-8443-5b4d3be7efd3 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: ZFlATEp8oAMFd9Q= x-content-type-options: nosniff x-amzn-trace-id: Root=1-63321b9b-3230e97a4fe34413285eb578;Sampled=0 x-amzn-remapped-date: Mon, 26 Sep 2022 21:37:31 GMT x-amz-cf-pop: HIO50-C1, SEA73-P1 x-cache: Miss from cloudfront x-amz-cf-id: kRSg9NTTAgeAJgIZ_C9_rRodCX4bzGduJEvNPNHUya0Moa2vsmWSoQ== via: 1.1 c7c3cdef911c9ee3c1a83a78f425dc5a.cloudfront.net (CloudFront), 1.1 2324edbcb8fc72f617442c65f36a40fc.cloudfront.net (CloudFront), 1.1 google date: Mon, 26 Sep 2022 21:38:57 GMT age: 22876 etag: "3d4fa8701f17e8818c25584ef5f04bfbee8440cd" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 13213 Md5: 62e68c3cd08dd94d910507512a67e85f Sha1: 3d4fa8701f17e8818c25584ef5f04bfbee8440cd Sha256: 058d798963f83f5fb88ab728185f755c5353fa981d93e1b6ff869089f501586b
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe29cee89-5693-407a-b182-e52f8fe5734f.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: img-getpocket.cdn.mozilla.net/296x148/filters:format(jp (...) FQDN: img-getpocket.cdn.mozilla.net IP: 34.120.237.76 HASH: eebf3b550e7a675a2231e97575e8be57e8d1216126a711cdef73ccbc5dd1e773 34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 11885 x-amzn-requestid: a8f6d57a-8bd3-42b9-80ba-695c5baac04b x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: YshLpHZPIAMFZiQ= x-content-type-options: nosniff x-amzn-trace-id: Root=1-6328157d-4ef5eb306dde741502e46f24;Sampled=0 x-amzn-remapped-date: Mon, 19 Sep 2022 07:08:45 GMT x-amz-cf-pop: SEA19-C2 x-cache: Hit from cloudfront x-amz-cf-id: JSWNUGbYq_zNf2L2AwkLuPfnGUTsX6iqCB5ESRr3dX-0voDgtu4KnQ== via: 1.1 0c96ded7ff282d2dbcf47c918b6bb500.cloudfront.net (CloudFront), 1.1 d8792dbd3191bbe722eba5b536b979c8.cloudfront.net (CloudFront), 1.1 google date: Mon, 26 Sep 2022 21:56:23 GMT age: 21830 etag: "03edfe254fa4f5c88bf9c8868edd9cdf07bf5d0d" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 11885 Md5: 1f0a1508f459d7774c0d63ff682532c0 Sha1: 03edfe254fa4f5c88bf9c8868edd9cdf07bf5d0d Sha256: eebf3b550e7a675a2231e97575e8be57e8d1216126a711cdef73ccbc5dd1e773
GET /favicon.ico HTTP/1.1 Host: go.monetizer.mobi User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://go.monetizer.mobi/?utm_term=7147904527885140061&ver=4viyaptcjo&utm_content=e6c2c6dcd68fd49594fc9695a6a79597828bb8888e8f8ebdb2c6b0c4b6b78587b2bb88b0bdb68cbd82b280b3b6b6bcb4aaaba9a9aeafacada293a1919697f8f4848f9b8a8f9f89c09291898c87959de5cbfbf8cbcaffcec9f2f3f085848291f5cafac8f8fcf7fccdf3f3f2f5c6c7c4c5dae8edebe8ebebebebebe6e2e0efece61b84 Cookie: u=17efd21951c8f38faa309233e309fc3a Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin TE: trailers	URL: go.monetizer.mobi/favicon.ico FQDN: go.monetizer.mobi IP: 198.143.165.221 HASH: b1d7aef06456fe7431124129a28f0138bb5fccfa4f4161e3087de23c005e5edc 198.143.165.221 HTTP/2 200 OK content-type: image/x-icon server: nginx date: Tue, 27 Sep 2022 04:00:13 GMT content-length: 1150 last-modified: Wed, 31 Jul 2019 07:48:51 GMT etag: "5d4147e3-47e" expires: Wed, 28 Sep 2022 04:00:13 GMT cache-control: max-age=86400 strict-transport-security: max-age=31536000; includeSubdomains; accept-ranges: bytes X-Firefox-Spdy: h2 --- Additional Info --- Magic: MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel\012- data Size: 1150 Md5: 91abe01116ab422c598e9c8af72cf4da Sha1: 0f2815fe8e067d48537ad168225ab4674271fa27 Sha256: b1d7aef06456fe7431124129a28f0138bb5fccfa4f4161e3087de23c005e5edc
GET /sw.js?v=1664251211093 HTTP/1.1 Host: go.monetizer.mobi User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Service-Worker: script Connection: keep-alive Cookie: u=17efd21951c8f38faa309233e309fc3a Sec-Fetch-Dest: serviceworker Sec-Fetch-Mode: same-origin Sec-Fetch-Site: same-origin Pragma: no-cache Cache-Control: no-cache TE: trailers	URL: go.monetizer.mobi/sw.js?v=1664251211093 FQDN: go.monetizer.mobi IP: 198.143.165.221 HASH: 70d55f6e4bab19ae4b3cc61642e88a78a599b060c72d10c15c5f937e34305ee9 198.143.165.221 HTTP/2 200 OK content-type: application/javascript server: nginx date: Tue, 27 Sep 2022 04:00:13 GMT content-length: 775 last-modified: Fri, 23 Sep 2022 11:12:42 GMT vary: Accept-Encoding etag: "632d94aa-307" content-encoding: gzip content-security-policy: default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src ; style-src 'unsafe-inline'; X-Firefox-Spdy: h2 --- Additional Info --- Magic: ASCII text Size: 775 Md5: de06f24ba6d6b0c514015a9847dace54 Sha1: c9662e4339d4f72af3526b21d4d6d68df21b0ba9 Sha256: 70d55f6e4bab19ae4b3cc61642e88a78a599b060c72d10c15c5f937e34305ee9
GET /?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7147904527885140061&website=797-403c551a&placement=797&utm_content=e6c2c6dcd68fd49594fc9695a6a79597828bb8888e8f8ebdb2c6b0c4b6b78587b2bb88b0bdb68cbd82b380b3b6b6bcb4aaaba9a9aeafacada293a1919697f8f4848f9b8a8f9f89c09291898c87959de5cbfbf8cbcaffcec9f2f3f085848291f5cafac8f8fcf7fccdf3f3f2f5c6c7c4c5dae8edebe8ebebebebebe6e2e0efece61b85 HTTP/1.1 Host: www.wewillserv.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://go.monetizer.mobi/ Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site	URL: www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2 (...) FQDN: www.wewillserv.com IP: 51.68.81.31 HASH: 041fbdf14ad1fb7f260c19e6be638b293ae6a761897ef98ef72b2c86065e8ea9 51.68.81.31 HTTP/1.1 200 OK Content-Type: text/html Date: Tue, 27 Sep 2022 04:00:13 GMT Transfer-Encoding: chunked Connection: keep-alive Cache-Control: no-transform --- Additional Info --- Magic: HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (3751) Size: 5152 Md5: 2bd509794d9e5146dfe092ddb127ae8f Sha1: ccdba35d96704f46c044b60ee1fbbda001debd6b Sha256: 041fbdf14ad1fb7f260c19e6be638b293ae6a761897ef98ef72b2c86065e8ea9
GET /proc.php?7aa6b76bb7b1da2c08e2a6b2bb8679cb3b55ffa0 HTTP/1.1 Host: go.monetizer.mobi User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://go.monetizer.mobi/?utm_term=7147904527885140061&ver=4viyaptcjo&utm_content=e6c2c6dcd68fd49594fc9695a6a79597828bb8888e8f8ebdb2c6b0c4b6b78587b2bb88b0bdb68cbd82b280b3b6b6bcb4aaaba9a9aeafacada293a1919697f8f4848f9b8a8f9f89c09291898c87959de5cbfbf8cbcaffcec9f2f3f085848291f5cafac8f8fcf7fccdf3f3f2f5c6c7c4c5dae8edebe8ebebebebebe6e2e0efece61b84 Cookie: u=17efd21951c8f38faa309233e309fc3a Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-origin TE: trailers	URL: go.monetizer.mobi/proc.php?7aa6b76bb7b1da2c08e2a6b2bb86 (...) FQDN: go.monetizer.mobi IP: 198.143.165.221 HASH: 71d28f8108b8a08eaf246fffd8268fe2fa5acd82dc9118ac430bea14dc484393 198.143.165.221 HTTP/2 200 OK content-type: text/html; charset=UTF-8 server: nginx date: Tue, 27 Sep 2022 04:00:13 GMT location: https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7147904527885140061&website=797-403c551a&placement=797 vary: Accept-Encoding x-powered-by: PHP/8.1.9 cache-control: no-store, no-cache, must-revalidate, max-age=0 pragma: no-cache expires: Thu, 01 Jan 1970 00:00:00 GMT strict-transport-security: max-age=31536000; includeSubdomains; content-encoding: gzip X-Firefox-Spdy: h2 --- Additional Info --- Magic: HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (3576), with no line terminators Size: 1547 Md5: e8a161691d32b04983d78a4c6e12e2c7 Sha1: 5a9e72ad05ec548943406810555e5a78fdfd7e58 Sha256: 71d28f8108b8a08eaf246fffd8268fe2fa5acd82dc9118ac430bea14dc484393
GET /?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7147904527885140061&website=797-403c551a&placement=797&utm_content=e6c2c6dcd68fd49594fc9695a6a79597828bb8888e8f8ebdb2c6b0c4b6b78587b2bb88b0bdb68cbd82b380b3b6b6bcb4aaaba9a9aeafacada293a1919697f8f4848f9b8a8f9f89c09291898c87959de5cbfbf8cbcaffcec9f2f3f085848291f5cafac8f8fcf7fccdf3f3f2f5c6c7c4c5dae8edebe8ebebebebebe6e2e0efece61b85&eyeg=3&eyer=0.6918226252601117&eyei=0&eyew=1280&eyeh=939&eyetd=220&eyef=go.monetizer.mobi HTTP/1.1 Host: www.wewillserv.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-origin	URL: www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2 (...) FQDN: www.wewillserv.com IP: 51.68.81.31 HASH: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 51.68.81.31 HTTP/1.1 302 Found Date: Tue, 27 Sep 2022 04:00:13 GMT Content-Length: 0 Connection: keep-alive Cache-Control: no-transform Location: https://admoustache.go2affise.com/sl?id=5f0efd61dabed1d602e0fe6a&pid=503&sub1=33000c5a0391e8ccfbbcca9e9f7408d9202e70927-202209-flb5467509-4538fM7147904527885140061sl_5467509-4538fdccb0a3cb6b4a731440efcb68deaa526e1f89153797-403c551a797 --- Additional Info --- Magic: Size: 0 Md5: d41d8cd98f00b204e9800998ecf8427e Sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /favicon.ico HTTP/1.1 Host: www.wewillserv.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin	URL: www.wewillserv.com/favicon.ico FQDN: www.wewillserv.com IP: 51.68.81.31 HASH: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 51.68.81.31 HTTP/1.1 204 No Content Server: openresty Date: Tue, 27 Sep 2022 04:00:13 GMT Connection: keep-alive --- Additional Info --- Magic: Size: 0 Md5: d41d8cd98f00b204e9800998ecf8427e Sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /sw.js?v=1664251211093 HTTP/1.1 Host: go.monetizer.mobi User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Service-Worker: script Connection: keep-alive Cookie: u=17efd21951c8f38faa309233e309fc3a Sec-Fetch-Dest: serviceworker Sec-Fetch-Mode: same-origin Sec-Fetch-Site: same-origin If-Modified-Since: Fri, 23 Sep 2022 11:12:42 GMT If-None-Match: "632d94aa-307" Cache-Control: max-age=0 TE: trailers	URL: go.monetizer.mobi/sw.js?v=1664251211093 FQDN: go.monetizer.mobi IP: 198.143.165.221 HASH: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 198.143.165.221 HTTP/2 304 Not Modified server: nginx date: Tue, 27 Sep 2022 04:00:14 GMT last-modified: Fri, 23 Sep 2022 11:12:42 GMT vary: Accept-Encoding etag: "632d94aa-307" content-security-policy: default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src ; style-src 'unsafe-inline'; X-Firefox-Spdy: h2 --- Additional Info --- Magic: Size: 0 Md5: d41d8cd98f00b204e9800998ecf8427e Sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /sl?id=5f0efd61dabed1d602e0fe6a&pid=503&sub1=33000c5a0391e8ccfbbcca9e9f7408d9202e70927-202209-flb5467509-4538fM7147904527885140061sl_5467509-4538fdccb0a3cb6b4a731440efcb68deaa526e1f89153797-403c551a797 HTTP/1.1 Host: admoustache.go2affise.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site	URL: admoustache.go2affise.com/sl?id=5f0efd61dabed1d602e0fe6 (...) FQDN: admoustache.go2affise.com IP: 34.90.46.36 HASH: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 34.90.46.36 HTTP/2 302 Found server: nginx date: Tue, 27 Sep 2022 04:00:14 GMT content-length: 0 location: https://t2.blowingwnd.com/l.php?p=c:o6450ylcdnn31butk&d=624e9ea3e8e2a8163b65d246&pid=6332754ea00dbc00017e8901&s=503 set-cookie: afclick=6332754ea00dbc00017e8901; expires=Wed, 27 Sep 2023 04:00:14 GMT; secure; SameSite=None access-control-allow-origin: * X-Firefox-Spdy: h2 --- Additional Info --- Magic: Size: 0 Md5: d41d8cd98f00b204e9800998ecf8427e Sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.77.32 HASH: 43169009e73d29c0b3a8c3b2f347f6428f965626816dc7dbabfe3ec5696cad73 23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "43169009E73D29C0B3A8C3B2F347F6428F965626816DC7DBABFE3EC5696CAD73" Last-Modified: Mon, 26 Sep 2022 05:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=2302 Expires: Tue, 27 Sep 2022 04:38:37 GMT Date: Tue, 27 Sep 2022 04:00:15 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: cc72a8c7d266f8d71f59e2fd61a8525e Sha1: 5ab009686feb617b00586243e2ec3d5886aa302a Sha256: 43169009e73d29c0b3a8c3b2f347f6428f965626816dc7dbabfe3ec5696cad73
GET /l.php?p=c:o6450ylcdnn31butk&d=624e9ea3e8e2a8163b65d246&pid=6332754ea00dbc00017e8901&s=503 HTTP/1.1 Host: t2.blowingwnd.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site	URL: t2.blowingwnd.com/l.php?p=c:o6450ylcdnn31butk&d=624e9ea (...) FQDN: t2.blowingwnd.com IP: 51.161.115.163 HASH: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 51.161.115.163 HTTP/1.1 302 Found Content-Type: text/html; charset=UTF-8 Server: nginx Date: Tue, 27 Sep 2022 04:00:15 GMT Content-Length: 0 Connection: keep-alive Round: 12bbr5cth7 Raund: 19q Location: https://48.us.findthewind.xyz/feed/?link=true&tid=48&subid=48.503&ref=&s1=6332754f8f89a04a095b73bb --- Additional Info --- Magic: Size: 0 Md5: d41d8cd98f00b204e9800998ecf8427e Sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.77.32 HASH: 99220615d230816afb78af6779d62dae30c501d418376dcccb89edf27fb4de16 23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "99220615D230816AFB78AF6779D62DAE30C501D418376DCCCB89EDF27FB4DE16" Last-Modified: Mon, 26 Sep 2022 04:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=10836 Expires: Tue, 27 Sep 2022 07:00:51 GMT Date: Tue, 27 Sep 2022 04:00:15 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 5014bc7b4cfedcdef14c35d0baf07baa Sha1: 06a45f69abd312a3c793ee5b89836316b15851de Sha256: 99220615d230816afb78af6779d62dae30c501d418376dcccb89edf27fb4de16
POST / HTTP/1.1 Host: ocsp.godaddy.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 75 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: ocsp.godaddy.com/ FQDN: ocsp.godaddy.com IP: 192.124.249.22 HASH: 0d8438abd1a634d426bf658f2a5f383cfdbab8b6b12a37885895166d8328c7da 192.124.249.22 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: Sucuri/Cloudproxy Date: Tue, 27 Sep 2022 04:00:15 GMT Content-Length: 1777 Connection: keep-alive X-Sucuri-ID: 19022 Content-Transfer-Encoding: Binary Cache-Control: public, no-transform, must-revalidate Last-Modified: Mon, 26 Sep 2022 23:43:15 GMT Expires: Tue, 27 Sep 2022 23:43:15 GMT ETag: "49b873c2bff6f2eba87397c2ba244b04b3c317eb" P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA" --- Additional Info --- Magic: data Size: 1777 Md5: 98917b3482df1fb9b63778a65d8de247 Sha1: 49b873c2bff6f2eba87397c2ba244b04b3c317eb Sha256: 0d8438abd1a634d426bf658f2a5f383cfdbab8b6b12a37885895166d8328c7da
GET /feed/?link=true&tid=48&subid=48.503&ref=&s1=6332754f8f89a04a095b73bb HTTP/1.1 Host: 48.us.findthewind.xyz User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site	URL: 48.us.findthewind.xyz/feed/?link=true&tid=48&subid=48.5 (...) FQDN: 48.us.findthewind.xyz IP: 23.235.251.114 HASH: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 23.235.251.114 HTTP/1.1 301 Moved Permanently Cache-Control: no-cache Location: https://redir.findthewind.xyz/click/invalid/?tid=48&subid=48.503 Date: Tue, 27 Sep 2022 04:00:16 GMT Connection: keep-alive Keep-Alive: timeout=5 Transfer-Encoding: chunked --- Additional Info --- Magic: Size: 0 Md5: d41d8cd98f00b204e9800998ecf8427e Sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.77.32 HASH: 9845e12580cbfc6263681ae1307766dd0955b0698f4ba0a0a18527e9595d1d93 23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "9845E12580CBFC6263681AE1307766DD0955B0698F4BA0A0A18527E9595D1D93" Last-Modified: Mon, 26 Sep 2022 04:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=18109 Expires: Tue, 27 Sep 2022 09:02:06 GMT Date: Tue, 27 Sep 2022 04:00:17 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 747e5d0b7cb7686662a71efa89dc4bdd Sha1: 4d9630aadfb716491bd35632f8cd8ebf1b5af55c Sha256: 9845e12580cbfc6263681ae1307766dd0955b0698f4ba0a0a18527e9595d1d93
GET /click/invalid/?tid=48&subid=48.503 HTTP/1.1 Host: redir.findthewind.xyz User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site	URL: redir.findthewind.xyz/click/invalid/?tid=48&subid=48.503 FQDN: redir.findthewind.xyz IP: 198.211.113.186 HASH: 877fbd10ae194b887dfff2de0a0439cde4b33ac994d1dc1b325e3eaac79f1c38 198.211.113.186 HTTP/1.1 302 Found Content-Type: text/html; charset=utf-8 X-Powered-By: Express Surrogate-Control: no-store Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate Pragma: no-cache Expires: 0 Location: https://cola.labtrffc.com/r.php?p=c:xecd97ullhqs49nas&d=62a055db84c90235f05e05a1&s=48 Vary: Accept Content-Length: 230 Date: Tue, 27 Sep 2022 04:00:17 GMT Connection: keep-alive Keep-Alive: timeout=5 --- Additional Info --- Magic: HTML document, ASCII text, with no line terminators Size: 230 Md5: 90febcb2a62ac7e4149297e66bf35f2e Sha1: d998f49976838f36db5ec5f8bee47f0ff6e1ddb3 Sha256: 877fbd10ae194b887dfff2de0a0439cde4b33ac994d1dc1b325e3eaac79f1c38
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.77.32 HASH: 6bb345b76a6642dc9e467d32e790aad616c906cfb2827c2814e3c2f9fa80764e 23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "6BB345B76A6642DC9E467D32E790AAD616C906CFB2827C2814E3C2F9FA80764E" Last-Modified: Mon, 26 Sep 2022 04:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=5740 Expires: Tue, 27 Sep 2022 05:35:57 GMT Date: Tue, 27 Sep 2022 04:00:17 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 28621e26836a4b332c7c4f733bafa8a7 Sha1: c98feb08517cf6518d0c9f49a345bd21945ae17d Sha256: 6bb345b76a6642dc9e467d32e790aad616c906cfb2827c2814e3c2f9fa80764e
GET /r.php?p=c:xecd97ullhqs49nas&d=62a055db84c90235f05e05a1&s=48 HTTP/1.1 Host: cola.labtrffc.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site	URL: cola.labtrffc.com/r.php?p=c:xecd97ullhqs49nas&d=62a055d (...) FQDN: cola.labtrffc.com IP: 51.83.143.92 HASH: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 51.83.143.92 HTTP/1.1 302 Found Content-Type: text/html; charset=UTF-8 Server: nginx Date: Tue, 27 Sep 2022 04:00:17 GMT Content-Length: 0 Connection: keep-alive Round: 12cca187zq Raund: 2fk Location: http://pollo.trffcsource.com/l.php?p=c:ta9_53qhga_krzx5f&d=62fb8110fa240e28771bb35b&s=48&pid=63327551c665ec7be64c856f --- Additional Info --- Magic: Size: 0 Md5: d41d8cd98f00b204e9800998ecf8427e Sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /l.php?p=c:ta9_53qhga_krzx5f&d=62fb8110fa240e28771bb35b&s=48&pid=63327551c665ec7be64c856f HTTP/1.1 Host: pollo.trffcsource.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Upgrade-Insecure-Requests: 1	URL: pollo.trffcsource.com/l.php?p=c:ta9_53qhga_krzx5f&d=62f (...) FQDN: pollo.trffcsource.com IP: 51.83.143.92 HASH: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 51.83.143.92 HTTP/1.1 302 Found Content-Type: text/html; charset=UTF-8 Server: nginx Date: Tue, 27 Sep 2022 04:00:17 GMT Content-Length: 0 Connection: keep-alive Round: 11yr45wnwa Raund: 10uu72ypsp-10vor7qos4-1qr Location: https://8.us.findthewnd.xyz/feed/?link=true&tid=8&subid=8.no&ref=&s1=633275517c4e7a33545f486d --- Additional Info --- Magic: Size: 0 Md5: d41d8cd98f00b204e9800998ecf8427e Sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.77.32 HASH: 35b6c64d6d14696eb4a8d1863cfc8151a4d84c09fa68448febb5d1ab49b95e74 23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "35B6C64D6D14696EB4A8D1863CFC8151A4D84C09FA68448FEBB5D1AB49B95E74" Last-Modified: Mon, 26 Sep 2022 04:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=18068 Expires: Tue, 27 Sep 2022 09:01:26 GMT Date: Tue, 27 Sep 2022 04:00:18 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: e77a0fdd1b3c5aa1933b65ab5b8e6392 Sha1: 2d5c2f94e08026f7f6759964d866c36f5dec5707 Sha256: 35b6c64d6d14696eb4a8d1863cfc8151a4d84c09fa68448febb5d1ab49b95e74
GET /feed/?link=true&tid=8&subid=8.no&ref=&s1=633275517c4e7a33545f486d HTTP/1.1 Host: 8.us.findthewnd.xyz User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site	URL: 8.us.findthewnd.xyz/feed/?link=true&tid=8&subid=8.no&re (...) FQDN: 8.us.findthewnd.xyz IP: 23.235.251.114 HASH: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 23.235.251.114 HTTP/1.1 301 Moved Permanently Cache-Control: no-cache Location: https://redir.findthewind.xyz/click/invalid/?tid=8&subid=8.no Date: Tue, 27 Sep 2022 04:00:19 GMT Connection: keep-alive Keep-Alive: timeout=5 Transfer-Encoding: chunked --- Additional Info --- Magic: Size: 0 Md5: d41d8cd98f00b204e9800998ecf8427e Sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /?utm_medium=ec4eee60be986151ad56a07d62a9c3fe7802b9db&utm_campaign=mainstream2021&1=1&cid=0b5d3df1-ff7c-4d7c-bf13-c29134ec1ce2 HTTP/1.1 Host: go.monetizer.mobi User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Cookie: u=17efd21951c8f38faa309233e309fc3a Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: none Sec-Fetch-User: ?1	URL: go.monetizer.mobi/?utm_medium=ec4eee60be986151ad56a07d6 (...) FQDN: go.monetizer.mobi IP: 198.143.165.221 198.143.165.221 HTTP/2 200 OK content-type: text/html; charset=UTF-8 server: nginx date: Tue, 27 Sep 2022 04:00:12 GMT location: https://go.monetizer.mobi/?utm_term=7147904527885140061&ver=4viyaptcjo vary: Accept-Encoding x-powered-by: PHP/8.1.9 cache-control: no-store, no-cache, must-revalidate, max-age=0 pragma: no-cache expires: Thu, 01 Jan 1970 00:00:00 GMT strict-transport-security: max-age=31536000; includeSubdomains; content-encoding: gzip X-Firefox-Spdy: h2 --- Additional Info ---
GET /?utm_term=7147904527885140061&ver=4viyaptcjo&utm_content=e6c2c6dcd68fd49594fc9695a6a79597828bb8888e8f8ebdb2c6b0c4b6b78587b2bb88b0bdb68cbd82b280b3b6b6bcb4aaaba9a9aeafacada293a1919697f8f4848f9b8a8f9f89c09291898c87959de5cbfbf8cbcaffcec9f2f3f085848291f5cafac8f8fcf7fccdf3f3f2f5c6c7c4c5dae8edebe8ebebebebebe6e2e0efece61b84 HTTP/1.1 Host: go.monetizer.mobi User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://go.monetizer.mobi/?utm_medium=ec4eee60be986151ad56a07d62a9c3fe7802b9db&utm_campaign=mainstream2021&1=1&cid=0b5d3df1-ff7c-4d7c-bf13-c29134ec1ce2 Cookie: u=17efd21951c8f38faa309233e309fc3a Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-origin TE: trailers	URL: go.monetizer.mobi/?utm_term=7147904527885140061&ver=4vi (...) FQDN: go.monetizer.mobi IP: 198.143.165.221 198.143.165.221 HTTP/2 200 OK content-type: text/html; charset=utf-8 server: nginx date: Tue, 27 Sep 2022 04:00:12 GMT vary: Accept-Encoding x-powered-by: PHP/8.1.9 cache-control: no-store, no-cache, must-revalidate, max-age=0 pragma: no-cache expires: Thu, 01 Jan 1970 00:00:00 GMT strict-transport-security: max-age=31536000; includeSubdomains; content-encoding: gzip X-Firefox-Spdy: h2 --- Additional Info ---

Overview

Domain Summary (20)

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Blocklists

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 52.58.131.39

Last 5 reports on ASN: AMAZON-02

Last 4 reports on domain: ketogermany.com

Last 5 reports with similar screenshot

JavaScript

Executed Scripts (7)

Executed Evals (0)

Executed Writes (0)

HTTP Transactions (43)

Overview

Domain Summary (20)

Network Intrusion Detection Systemsinfo

Suricata /w Emerging Threats Pro

Blocklists

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 52.58.131.39

Last 5 reports on ASN: AMAZON-02

Last 4 reports on domain: ketogermany.com

Last 5 reports with similar screenshot

JavaScript

Executed Scripts (7)

Executed Evals (0)

Executed Writes (0)

HTTP Transactions (43)

Network Intrusion Detection Systems